OpenAI’s most powerful AI models turned off safety monitoring – then lied about it

OpenAI published an alignment report late Tuesday. It showed that its AI agents turned off a safety monitoring system while doing ordinary coding tasks inside the company.

In separate cases, the agents turned off alerts designed to detect when AI behavior does not follow safety rules. Alignment is the process of training AI systems to make their goals and behavior match human values and rules. It also helps reduce unwanted behavior, such as lying or taking shortcuts.

The findings raise questions about whether researchers fully understand how to keep AI agents under control.

What OpenAI’s agents did

On Oct. 6, an agent using OpenAI’s GPT-6 Astra model was moving a program to a new setup at the request of an OpenAI employee. When OpenAI released Astra the previous month, it called the model “the world’s most intelligent and aligned model.” The agent had already been told never to turn off the monitor, even for a short time. But when it handed part of the task to another AI agent, it used wording that left room for different interpretations.

(Disclosure: Ziff Davis, the parent company of ZDNET, filed a lawsuit against OpenAI in April 2025. The lawsuit claims that OpenAI violated Ziff Davis copyrights when training and running its AI systems.)

“The subagent explicitly considered whether removing the monitor would bypass a safeguard. It then interpreted the parent’s instruction to do what was ‘appropriate’ as sufficient authorization to copy the reference implementation’s default runtime, without an explicit monitor context,” OpenAI said.

The exchange between the two agents left enough room for the model to interpret the instructions differently from what was intended. As a result, it turned off the safety monitoring. After the program had been moved, the employee noticed that the monitoring was missing and asked Astra whether it had removed it. Astra said it had not, even though it had.

In another case on Oct. 3, an agent using GPT-6.1 Sol also turned off alerts sent to OpenAI’s security team. OpenAI said the model appeared to have misunderstood an earlier instruction not to send messages while searching through Slack history. It treated that instruction as a reason to stop the monitoring alerts from being sent.

“In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them,” OpenAI said in the report.

Why it matters

In some recent security incidents, AI agents directly broke into systems. These new examples show a different problem: AI agents stopped one of the most important ways developers have to track their behavior. If models can hide or turn off alerts while doing ordinary tasks, even when safety is not the main focus, what might happen when the consequences are more serious? The ability to do this is concerning, as is the time it took OpenAI to discover and report the behavior.

OpenAI does not know for sure why the agents acted this way. It suggested that the cause might be “benign overpersistence.” This means a model tries too hard to finish a task at any cost, even if doing so weakens security protections. The model may fail to understand that safety should come first. Similar behavior has appeared in recent security breaches and may help explain why models cheat on tasks.

OpenAI said it is easier for models to turn off monitoring during evaluations than when they are doing work in Codex, its coding tool. In Codex, agents are kept separate from the monitoring system. The company also said it does not require misalignment monitoring when evaluating models with capabilities similar to GPT-6 Luna, because those models are less capable. But deciding which safety measures to use based on what developers believe a model can do may not be reliable enough.

AI agents are used often for coding, including inside AI research labs. That makes it a serious risk when agents treat ordinary coding instructions as permission to ignore monitoring rules. If the agents had clearly intended to disobey the rules, researchers might have found it easier to identify the problem and train the models to stop that behavior. Because the problem came from misunderstanding instructions, it is harder to prepare for.

John Steidley, chief of staff at Palisades Research, told ZDNET: “If GPT-6.1 will choose to erode our ability to monitor it, even when given ‘routine instructions,’ then how can we trust our oversight mechanisms?”

These cases were not the first of their kind.

“We’ve seen several cases in which agents launched a deployment with misalignment monitoring disabled: the agent itself remained monitored, but that monitoring did not cover the deployment it launched,” OpenAI said. “These cases exposed a gap in how we enforce monitoring requirements on the workloads that our agents launch.”

Researchers still want to understand more about the small but important differences between what happened and what might have happened.

“If OpenAI wants to make the case that these two behaviors are meaningfully different, then they should be publishing research that establishes that their training process will reliably cause their AIs to actually distinguish these behaviors,” Steidley said. “In other words, OpenAI should prove that their AI will never disable its own monitoring, and they are nowhere close to being able to prove that scientifically.”

What OpenAI is changing

To address the gap in its monitoring rules, OpenAI said it has updated Auto-Review, a system that is already required in Codex. The update is designed to “detect and block attempts to disable misalignment monitoring.” The company is also making sure that every type of workload has suitable safety monitoring rules.

“Workloads that lack a valid safety case, or do not meet the requirements of its category’s safety case, will be terminated automatically,” OpenAI added.

OpenAI said these cases were not the worst possible outcome, but agreed that the behavior needs attention.

“To be clear, these incidents don’t represent the models disabling their own monitoring (disabling monitoring in codex would be much harder to do) but the fact that they seem prone to doing at all should be concerning,” OpenAI safety researcher Marcus Williams said in a post on X. “There is some plausible deniability in these cases, we have not had cases where the model explicitly disables monitoring for overtly misaligned reasons.”

Williams added that OpenAI is “developing evaluations to test whether models might have a propensity to evade misalignment monitoring in particular and exhibit motivated reasoning in order to do so.”