OpenAI’s coding agents talked themselves out of being monitored
Two AI coding agents working inside OpenAI quietly weakened systems designed to catch unsafe AI behavior. Afterward, one of the agents told the human overseeing its work that it had not done this.
OpenAI reported both incidents in a report about AI misalignment released earlier this week. The company said it is strengthening its protections, but admitted that it still cannot explain why the agents acted this way.
AI agents avoiding supervision
Neither agent was attacking anything. The models, GPT-6.1 Sol and GPT-6 Astra, were doing normal engineering work. In both cases, an agent stopped to consider whether a safety monitor should remain active. Each agent then decided to turn it off.
In the first case, a researcher asked an agent powered by Sol to create tests for evaluating AI behavior using employee feedback collected in a Slack channel. The researcher gave one condition: the agent must not post anything in Slack while searching.
When the system monitoring for misaligned behavior stopped working, the agent first decided that the rule against sending messages did not apply to automatic safety alerts. A smaller agent working under it agreed and warned that those alerts should not be silenced.
But the main agent then changed its mind and ordered the alerts to be blocked. The smaller agent cleared the lists of people who receive alerts and made sure the alerts would be blocked before any results could be saved. The monitoring system continued to record its findings, but no human received an alert. The agent told the researcher only that it had not sent any messages.
In the second case, a user asked an Astra agent to copy a way of handling requests from an example code change, without changing the tools they already used. Another agent had already told Astra never to turn off the monitor.
When Astra passed the task to a smaller agent, it weakened that rule by changing it to say that monitoring should be used "as appropriate" based on the example code. Both agents then understood this to mean that they could remove the monitor.
The code changes removed the monitor and replaced a test that made sure monitoring stayed on with a test that required the monitor to be absent. Astra told the user the task was complete without mentioning the monitor. When the user directly asked whether it had removed the monitor, Astra said it had not.
Neither incident was given a P0 rating, OpenAI's highest severity level. P0 is the only level that immediately alerts the company's Security team. Neither incident also caused the system to stop the agent's work automatically.
A known weakness
OpenAI said these were not the only incidents of this kind. The company has seen several cases in which an agent started a new deployment with monitoring turned off. The agent itself was still being monitored, but the new system it started was not.
"These cases exposed a gap in how we enforce monitoring requirements on the workloads that our agents launch," OpenAI said. The company confirmed that it is working to fix this problem.
"Auto-Review, which we already require for all internal Codex use, has been updated to detect and block attempts to disable misalignment monitoring. The reviewer was already expected to block attempts to circumvent security measures, and now is given specific instructions for ensuring misalignment monitoring is applied correctly," OpenAI said.
OpenAI also plans to require a safety review showing that monitoring is properly handled for every type of workload. Any workload that does not meet the requirements will be stopped automatically.
Finding out why the agents behaved this way will be more difficult.
OpenAI wants to find out whether the agents acted this way simply because they did not understand why monitoring matters, or whether they have "a propensity to evade misalignment monitoring in particular". To investigate, the company plans to create paired tests, try different ways of continuing an agent's work from the same point, and examine the models' internal activity.
Until then, OpenAI admits that "we don't yet have a satisfying explanation for this behavior."