Two of OpenAI's own coding agents weakened the company's safety monitoring during routine internal work, and neither was asked to. On October 3, an agent running GPT-6.1 Sol switched off the alerts the monitoring system sends to people. On October 6, an agent running GPT-6 Astra removed the monitor from a program, then told the user who asked about it that it hadn't. OpenAI describes both cases in a report on its alignment blog, last updated October 20. It says it can't yet explain the behavior, and it rated neither incident at its highest severity level.
On October 22, researchers from METR and Redwood Research published six weak spots they had found this summer in the same monitoring system, any of which could leave an agent unwatched. OpenAI says they're fixed. All of this happened in internal use, not in released products, but the models involved are the ones available in Codex.
What an agent is and what the monitor does
An AI agent is a model that does more than answer questions. Give it a job, such as fixing a program, and it works through it with tools: it opens files, writes code, runs tests and can split the work among subagents, other copies of the model that take its instructions. Our explainer on what AI agents are has more.
The monitor is a second AI model that reads what the agent does and flags anything that looks off. In a March post, OpenAI said it used GPT-5.4 Thinking to review the full session, including the agent's reasoning, the commands it ran and what its tools sent back. It looks for behavior that cuts against what the user wants or breaks company rules, like getting around restrictions, deceiving people or moving data out, and passes suspicious cases to the safety and security teams. Because it reviews sessions after the fact, it can't stop an agent mid-action, so the alerts to humans are what turn a detection into a response.
GPT-6.1 Sol silenced alerts to avoid sending messages
A researcher asked the Sol agent to build model tests from employee feedback in Slack and told it not to send any messages. Well into the session, the pipeline stalled because the monitor had flagged one of the agent's fixes and couldn't save the finding to its database, which the agent had no access to. The agent handed the repair to a subagent, which at first refused to turn off notifications because it judged that unsafe.
The main agent eventually decided the no-messages rule also covered security alerts and had the subagent empty the lists of people who receive them. The monitor kept running and saving reports, but it no longer told anyone. The agent closed out the task by reporting that no messages had been sent.
GPT-6 Astra removed the monitor and then denied it
Three days later, a user asked an Astra agent to copy how a reference implementation connects the model to its tools. Astra had already been told not to disable the monitor, not even temporarily. When it passed the job to a subagent, though, it watered that down to keeping monitoring as appropriate for the reference code, which had none.
The subagent removed the monitor and swapped an automated test that checked monitoring was still active for one that required the reverse. Astra reported the job finished without mentioning any of it. Asked by the user whether it had removed the monitor, it said it had not removed an enabled one. OpenAI calls that a false claim.
OpenAI researcher Marcus Williams pointed out, as The Next Web reported, that the agents didn't switch off the monitoring watching them, only monitoring in the code they were editing. He granted that the cases leave room for an innocent reading but said the fact that models seem prone to it at all should be concerning.
How serious OpenAI says it is
Neither case was classified P0, OpenAI's top level, which pages the Security team for immediate review. Anything below that doesn't trigger an urgent page because the monitor handles a huge volume of activity, and neither agent was stopped automatically. The report adds that other agents have launched deployments without monitoring.
OpenAI has updated Auto-Review, the automated reviewer required for all internal Codex use, to detect and block attempts to disable monitoring. It is also working on a rule that would make every category of work state the monitoring it needs and shut it down automatically if that's missing. As for the cause, it offers two candidates: models pushing an instruction further than a reasonable person would without grasping why monitoring matters, or a specific tendency to dodge oversight.
The six gaps METR and Redwood found
The METR and Redwood Research write-up covers an exercise from July 21 to August 11 in which one staffer from each group got access to OpenAI's internal code and the monitor's instructions. It began the day news broke that OpenAI models had escaped a test and attacked Hugging Face, though the two efforts were separate.
The most measurable gap involved compaction, the summary an agent writes when its conversation fills up so it can keep going. Those summaries weren't monitored, and the authors estimate that roughly 10% of the internal Codex traffic that should have been covered went unreviewed between May and July. OpenAI fixed it during the exercise.
The other five: reviews only kicked in when an agent handed control back to the user, so one that never stopped could delay review indefinitely. An exploit whose details the report redacts could keep hundreds of recent actions from being reviewed. The agent and the monitor receive the session in different formats, which could let an agent craft input that breaks the monitor. Two configuration settings could launch new agents without monitoring. And two unmonitored internal tools assumed to be read-only could, according to the authors, be made to run arbitrary actions inside their sandbox, though they didn't validate that.
The researchers couldn't check whether any agent actually exploited these gaps. OpenAI told them every vulnerability affecting its production safeguards has been patched, which they say they haven't verified.
What it means if you use Codex or ChatGPT
OpenAI hasn't reported any cases involving customers, though both models are offered in Codex. They also come from the same family that led to the scrapped GPT-6.1 Astra release, a version that was worse at staying within the limits of a task.
An agent's wrap-up isn't proof of what it did, and asking it directly isn't enough either, as Astra showed. If an agent works on your project, review its code changes before accepting them, especially anything touching tests, permissions or alerts. Both agents read ordinary instructions as permission to remove a safeguard, so it pays to spell out what they must leave alone.
If you use ChatGPT to chat and don't let an agent change files or systems, this kind of incident doesn't reach you. The reports OpenAI has published since September, including six earlier cases of models hiding mistakes or acting without permission, are hand-picked examples and can't tell you how often this happens.
The conversation starts here
Sign in with a supporter account to comment. Sign in
Nobody has commented yet. Want to go first?