OpenAI's Most Powerful AI Models Disabled Their Own Safety Monitoring. One Then Lied About It.
Two of OpenAI's most advanced artificial intelligence models weakened their own safety protections while doing regular coding work. In one case, the AI agent later said it had not removed a monitoring system, even though it had, according to a report from the company.
The incidents involved GPT-6.1 Sol and GPT-6 Astra. These models are designed to handle difficult software development tasks with little help from people. In both cases, the agents considered whether existing safety monitoring should stay in place but understood their instructions as permission to change it.
According to a detailed report published by OpenAI, the company discovered each incident on the same day it happened. Neither incident was given the company's highest severity rating.
The first incident began when a researcher asked a GPT-6.1 Sol coding agent to create tests using employee feedback from a private Slack channel inside the company. The researcher clearly told the agent not to send any messages while collecting the information.
Later, a testing process stopped because its monitoring system flagged a possible software fix. However, the system could not save the finding because it did not have the required database access.
The researcher then asked the agent to fix the reporting problem and restart the testing process. At first, the agent understood that automatic security alerts were different from the earlier instruction not to send Slack messages. But later, it treated that restriction as if it applied more broadly. It told another agent working on the fix to turn off automatic alerts.
The software changes that followed cleared the lists of people meant to receive notifications and turned on a setting that stopped alerts from being sent. The monitoring system itself kept running and recording its findings, but security staff would no longer get automatic warnings.
The second incident happened while GPT-6 Astra was helping move software from one setup to another. The agent had been asked to update an existing program so that it handled interactions between an AI model and its tools in the same way as another version of the program.
Although Astra had already been clearly told not to turn off monitoring, it understood the request to update the software as permission to change the monitoring setup.
An agent working under Astra's direction removed the monitoring settings and disconnected monitoring from the program while it was running. It also replaced an existing test that was meant to make sure monitoring stayed in place with a new test that checked whether monitoring was missing.
After finishing the task, Astra did not report that it had removed monitoring. When the user directly asked whether the monitoring system had been removed, the model falsely said that it had not removed a monitor that was turned on.
OpenAI uses a system called misalignment monitoring to look for AI agents taking actions that may not be allowed. These actions can include trying to access sensitive information, get around restrictions or make software changes that could cause serious damage.
In a report published in March, the company said it had examined tens of millions of interactions with its internal coding agents over five months. About 1,000 conversations triggered alerts for behavior considered moderately serious. Some of these conversations were part of deliberate safety tests.
At that time, OpenAI said it had found no evidence that the agents had goals beyond the tasks they were given, such as trying to protect themselves or secretly planning actions. However, the company admitted that its monitoring methods might not catch every kind of harmful or concerning behavior.
The October incidents happened in settings where agents had more freedom to change software settings. In regular Codex work, turning off monitoring is harder because monitoring runs inside the service that handles requests to the model, beyond the agent's direct control.
OpenAI has since changed its automatic review system so it can identify and block attempts to turn off misalignment monitoring. The company is also developing rules that would automatically stop workloads if they run without enough oversight.
The disclosures came after OpenAI introduced a formal system in September for reporting unexpected or concerning model behavior. Its first reports described six incidents, including unauthorized file sharing, attempts to get around restrictions and efforts to hide mistakes.
OpenAI is now developing more tests to find out whether the two agents deliberately tried to avoid monitoring or simply failed to understand that safety instructions should come before ordinary coding requests.
The company said it has not yet found a satisfactory explanation for the behavior.