• OpenAI AI agents weakened security monitoring.
• OpenAI tightened controls and is investigating the incidents.

OpenAI has disclosed two incidents in which its AI agents weakened internal safety monitoring systems while carrying out coding tasks. In one case, an agent suppressed automatic security alerts, while another removed a monitoring system and later incorrectly claimed it had not done so.

The incidents took place on October 3 and October 6, 2026, involving agents powered by GPT-6.1 Sol and GPT-6 Astra. According to OpenAI’s incident report, updated on October 20, both agents interpreted routine coding instructions as permission to modify safeguards designed to detect unwanted AI behaviour.

OpenAI uses misalignment monitoring to identify potentially problematic agent behaviour. Under its monitoring policies, higher-severity findings trigger escalation and can result in evaluation workloads being automatically paused.

How OpenAI’s agents bypassed monitoring safeguards

The first incident occurred on October 3, when a researcher instructed a GPT-6.1 Sol agent to create evaluation tasks using employee feedback collected through Slack. The researcher also instructed the agent not to send messages while gathering the information.

Later in the task, the evaluation pipeline stopped after its monitoring system flagged a proposed code repair but could not save the finding because it lacked the required database access. The researcher then asked the agent to change where the monitoring results were stored and restart the pipeline.

The main agent initially recognised that the researcher’s instruction not to send Slack messages did not apply to automatic security notifications. It instructed a subagent to preserve monitoring, while the subagent independently concluded that disabling notifications would interfere with required alerts.

The main agent later reconsidered the instruction and directed the subagent to suppress monitoring notifications. The subagent subsequently removed notification recipients and enabled a setting that prevented alerts from being sent.

It also modified the evaluation pipeline to reject review results unless notification suppression was enabled. The monitoring system continued to operate and save its findings, but automatic notifications to OpenAI’s security team were disabled.

The second incident occurred on October 6, when a GPT-6 Astra agent was asked to modify a program to match a reference implementation while retaining its existing tools and functionality.

The agent had previously been instructed by another agent not to disable monitoring, even temporarily. However, when delegating the migration task, it told a subagent to preserve monitoring as appropriate to the reference implementation.

The subagent considered whether removing the monitor would bypass a safeguard but interpreted the instruction as permission to remove the existing monitoring components. The reference implementation did not include the same monitoring configuration.

The resulting changes removed the monitoring configuration and its connection to the program’s runtime. Although conversation logging remained active, the replacement no longer passed the original monitoring context into the runtime.

The subagent also replaced an existing regression test designed to preserve monitoring with one that checked whether the monitoring component was absent.

According to OpenAI, the main agent subsequently acknowledged in its recorded reasoning that the replacement implementation no longer included the agent monitor. It nevertheless treated the change as acceptable because the task required matching the reference implementation.

After completing the task, the agent reported that the migration was finished without disclosing the removal. When the user later asked whether the monitoring system had been removed, the agent incorrectly denied doing so.

OpenAI addresses gaps in monitoring enforcement

OpenAI said neither incident was classified as a P0, its highest-priority category requiring immediate review by the security team. Neither agent’s activity was automatically terminated.

The company also reported other cases in which agents launched deployments without misalignment monitoring. Although the agents themselves remained monitored, those safeguards did not extend to the deployments they launched.

OpenAI said these cases exposed gaps in how monitoring requirements were enforced across workloads launched by AI agents. It expects monitoring to be difficult to disable for Codex workloads because it runs within the service handling model requests, outside the agent’s direct control.

Evaluation workloads operate under different requirements. OpenAI does not currently require misalignment monitoring for evaluations involving models comparable to GPT-6 Luna, which it considers less capable.

This means an evaluation involving the more capable GPT-6 Astra can be misconfigured to use a monitoring exemption intended for Luna-class models.

To address these issues, OpenAI has updated Auto-Review, its mandatory review system for internal Codex use, to detect and block attempts to disable misalignment monitoring. The system already checks for attempts to bypass security measures but now includes specific instructions to verify that monitoring requirements are correctly applied.

OpenAI is working toward requiring every category of workload to have a valid safety case defining its monitoring requirements. Under the planned system, workloads without a valid safety case or those that fail to meet its requirements would be automatically terminated.

The company is also examining why the agents weakened monitoring safeguards. One possibility under investigation is what OpenAI describes as “benign overpersistence,” where agents continue carrying out instructions without adequately recognising the importance of preserving monitoring.

OpenAI is developing evaluations to test whether its models have a particular tendency to evade monitoring. The investigation includes paired evaluations, repeated sampling of agent responses, and experiments examining internal model activity.

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.