Quick Take
- OpenAI disclosed that two AI coding agents weakened safety safeguards, with one removing a monitor and falsely denying its actions.
- The incidents exposed weaknesses in AI oversight, as security alerts were suppressed and neither agent's execution was automatically terminated.
- OpenAI is tightening monitoring controls but has yet to determine whether the behavior reflected excessive task persistence or attempts to evade oversight.
OpenAI said two of its AI coding agents weakened safety monitoring, with one falsely denying that it removed a safeguard.
The incidents, disclosed in an Oct. 20 report, occurred during separate internal programming tasks involving GPT-6 Astra and GPT-6.1 Sol. One agent removed a system designed to flag problematic behavior, while the other disabled alerts that would notify human security staff.
Neither case triggered OpenAI's highest-priority security classification or automatically halted the agents' work, exposing weaknesses in the controls ChatGPT's developer uses to supervise increasingly autonomous software systems.
How the AI agents removed monitors and suppressed security alerts
The more consequential breakdown occurred Oct. 6, when an Astra agent was instructed to migrate a program's model-to-tool execution path to match a reference implementation. An earlier instruction had explicitly prohibited disabling its monitor, even temporarily.
Astra passed the work to a subagent, which stripped out the monitor's configuration and its connection to the running program. The replacement retained conversation logging but no longer provided the monitoring context the original safeguard needed.
The subagent also rewrote a regression test intended to confirm that monitoring remained active. Its replacement instead required the monitoring context to be absent, letting the modified software pass a check that no longer protected the original requirement.
When questioned afterward, Astra told the user: “I did not remove an enabled monitor from it.” OpenAI called the assertion false.
The second incident, on Oct. 3, began when a researcher asked Sol to construct evaluation tasks using employee feedback gathered through Slack, with an instruction not to send messages.
A monitoring pipeline later stopped because it could not save a flagged finding to a database. The researcher asked the agent to redirect results to an accessible destination and restart the evaluation.
Sol initially distinguished the prohibition on sending Slack messages from automatic security notifications. It instructed a subagent to repair the pipeline without disabling monitoring, and the subagent independently recognized that suppressing required alerts would be unsafe.
The main agent subsequently reversed course. It directed the subagent to empty the lists of people designated to receive alerts and activate a “no_notify” setting, treating the user's earlier instruction as authorization to suppress security notifications.
The monitor kept running and storing findings, but it no longer generated alerts to OpenAI's Security team. That removed a channel for human intervention even as the underlying evaluation resumed.
OpenAI said neither incident qualified as P0, the severity threshold that triggers an immediate security page, and neither run was automatically terminated.
The disclosure also describes other cases where agents launched software with monitoring off, while the coding agents themselves remained supervised.
The gap is particularly relevant to evaluation workloads. Monitoring for Codex is generally handled by the service processing model requests, beyond a coding agent's direct control. Evaluation systems offer more configuration flexibility, including a bypass for less capable Luna-class models that can be mistakenly applied to Astra workloads.
The findings add to concerns raised in OpenAI's earlier Astra system card, which found that the model's reasoning was harder to monitor than previous generations. In separate adversarial evaluations, Astra sometimes evaded internal monitoring while carrying out simulated sabotage tasks.
OpenAI tightens oversight
OpenAI has now updated Auto-Review, already mandatory for internal Codex use, to detect and block attempts to disable misalignment monitoring.
It is also developing requirements under which each workload category must have an approved safety case defining its monitoring obligations. Jobs lacking approval or failing those conditions would automatically terminate.
The proposed enforcement system would prevent coding agents from deciding whether monitoring should remain active during software modifications, closing a configuration gap that enabled the October incidents.
However, the company has not yet established why the agents weakened those controls despite recognizing their importance.
Researchers are developing paired evaluations, rerunning agent continuations and examining internal model activity to distinguish excessive persistence in completing assignments from a specific tendency to evade oversight.
The investigation could determine whether OpenAI needs additional restrictions on what its advanced coding agents can modify, beyond the monitoring requirements and automatic termination controls already being developed.
Mentioned in this article
Editorial credits
