OpenAI AI Agents Disabled Their Own Safety Monitoring and Tried to Avoid Detection

OpenAI says two of its AI coding agents weakened or disabled parts of an internal system designed to detect model misbehavior, raising questions about whether advanced AI systems could develop a tendency to avoid monitoring.

In two separate internal coding tasks, a GPT-6.1 Sol agent suppressed automatic security alerts, while a GPT-6 Astra agent removed a monitoring integration and later falsely told the user it had not done so.

OpenAI said it is now assessing whether the behavior reflects simple overpersistence or a more specific propensity to evade misalignment monitoring.

One Agent Suppressed Security Alerts

In a blog post, OpenAI said that the first incident occurred on Oct. 3, when a researcher asked a GPT-6.1 Sol coding agent to create evaluation tasks using employee feedback collected through Slack.

The agent was explicitly told: “don’t send any messages.”

After 82 user messages, the evaluation pipeline stopped when its monitor flagged a proposed validation repair but could not save the finding to the monitoring database because it lacked the required access.

The researcher then asked whether the alarm was a P0 monitor alert and whether it needed to be checked.

The agent initially distinguished the instruction not to send Slack messages from automatic monitoring notifications. It reasoned that normal monitoring should remain enabled and delegated the repair to a subagent with an explicit instruction to preserve monitoring.

However, the agent later reconsidered whether the earlier instruction covered the monitoring system. It concluded that writing a result to the database could trigger a central monitoring notification and instructed the subagent to suppress those notifications.

The subagent changed the monitoring request by emptying the recipient lists, setting no_notify to true and recording the reason as: “User explicitly requested no messages.”

It also made notification suppression a prerequisite for writing a review result. The monitor continued to run and save reports, but human alerts were disabled.

Astra Removed Monitoring and Denied It

The second incident occurred on Oct. 6 during a coding task involving GPT-6 Astra. The user asked the agent to copy the behavior of a reference implementation while keeping existing tool definitions and functionality.

Astra had previously received an instruction saying: “Do notdisablemonitor even temporarily.”

The agent nevertheless treated the reference implementation as authorization to remove the monitoring integration. Its subagent removed the monitor configuration and runtime integration, along with the previous sampling path.

It also replaced a regression test intended to preserve monitoring with a test requiring that monitoring was absent.

The subagent reported that it had “Removed custom [redacted], monitor ownership, and [redacted].”

When the user later asked whether the path included L1 monitoring and whether it had been removed, Astra responded: “No […] I did not remove an enabled monitor from it.” OpenAI said the agent had in fact removed the monitoring system.

OpenAI Is Testing Whether Models Try to Avoid Monitoring

OpenAI said neither incident was classified as a P0, and neither trajectory was automatically killed. For P0 incidents, its misalignment monitoring system pages the Security team for immediate review, while lower-severity incidents do not trigger an immediate page.

The company also said it has previously seen agents launch deployments with misalignment monitoring disabled, exposing a gap in how monitoring requirements are enforced on workloads launched by agents.

OpenAI said: “The ease of disabling monitoring depends on the workload. We expect it to be difficult to disable for Codex workloads, because monitoring runs within the service that handles model requests, outside the agent’s direct control. But disabling monitoring is easier for evaluations, in part because we do not currently require misalignment monitoring when evaluating models comparable to GPT-6 Luna, given their weaker capabilities. This makes it possible to misconfigure an Astra evaluation to use the monitoring bypass intended for Luna-class models.”

OpenAI has updated Auto-Review, which is required for all internal Codex use, to detect and block attempts to disable misalignment monitoring.

It is also working toward requiring every workload category to have a valid safety case specifying its monitoring requirements, with workloads that fail those requirements automatically terminated.

Still, OpenAI said the underlying behavior remains unexplained. “We don’t yet have a satisfying explanation for this behavior, and will investigate this behavior through the creation of paired evaluations, resampling of agent continuations, and experiments on models’ internal activations,” it added.