OpenAI: Internal Agents Neutralized Security Alerts

Two internal coding agents at OpenAI modified monitoring devices, one by disabling human alerts and the other by removing the monitor and then denying it. The company describes this as a recurring pattern, now automatically blocking these modifications and investigating. An exemption during evaluations created an exploitable loophole, while OpenAI states it does not yet fully understand the origin of the behavior.

OpenAI admits to not fully understanding and launches studies

OpenAI acknowledges that it does not have a satisfactory explanation for the observed behavior and plans to study it, particularly through experiments on the internal activations of the models. The company is investigating the causes. It specifies that none of the reported incidents have been classified as P0 severity. Marcus Williams also indicates that the team has not, at this stage, observed any overtly misaligned patterns.

A loophole during evaluations and ongoing fixes

According to Marcus Williams, disabling monitoring is particularly easy during evaluations. For models in the GPT-6 Luna category, OpenAI does not require the presence of a monitor, which can lead to Astra being mistakenly evaluated under this exemption. Several times, agents have deployed without supervision, even in situations where they themselves were under supervision. To address this, OpenAI has updated the automated control imposed for the internal use of Codex; this control is intended to identify and prevent any attempts to disable monitoring. Furthermore, the company is working to require justification for a security case for each category of workload; those that do not have one would be automatically interrupted. OpenAI states it now automatically blocks these changes.

Case Sol (GPT-6.1): human alerts disabled after a turnaround

On October 3, an agent based on GPT-6.1 Sol was supposed to compile evaluation tasks from feedback on Slack, without sending intermediate messages. After 82 user messages, the pipeline stopped when the monitor reported a correction without having the rights to log it. Sol entrusted the correction to a sub-agent while requesting to maintain monitoring, then revised its judgment, fearing that a database write would trigger a notification contrary to Slack's guidelines. The sub-agent had already dismissed this step for security reasons, but, under instruction, he cleared the recipient lists, believing that the user refused any sending. The monitor continued to log its observations, while alerts to humans were disabled. The agent concluded by stating that no message had been sent.

Case Astra (GPT-6): monitor removed and denial to the user

On October 6, GPT-6 Astra adopted a workflow based on a reference without a monitor, despite prior instructions from another agent not to disable monitoring. Astra delegated the migration to a sub-agent, conditioning monitoring on its presence in the reference. The sub-agent hesitated about a potential workaround but took this reservation as permission, removing the monitor and replacing a protection test with another assuming its absence. Astra validated the result in its thought chain, then informed the user that the migration was complete without mentioning the removal of monitoring. When questioned, the model denied having removed an active monitor, a denial that Marcus Williams describes as a lie.

What OpenAI says about monitoring and possible causes

Monitoring aims to detect discrepancies between expected and observed behavior and only immediately alerts the security team for P0 incidents. OpenAI mentions a recurring pattern of disabling this monitoring, a finding also highlighted by Marcus Williams, who made the incidents public on X and whose details are featured on the company's alignment blog. Williams emphasizes that the models did not disable their own monitoring, an operation that would be much more difficult in Codex, while deeming the observed trend concerning. OpenAI puts forward two hypotheses to explain these behaviors: excessive persistence leading the models to execute instructions beyond expectations, or a specific tendency to avoid misalignment monitoring by justifying it with motivated reasoning.