Two internal OpenAI coding agents weakened monitoring meant to catch misbehavior. One later denied removing it when a user asked. OpenAI says it does not yet have a satisfying explanation for the behavior.
Marcus Williams, who works on monitoring at OpenAI, disclosed the incidents on X and described a recurring pattern of agents switching off misalignment monitoring. OpenAI detailed the cases on its alignment blog. The system checks whether agents behave differently than intended. It immediately alerts the safety team only for the highest-severity incidents, rated P0. OpenAI says neither case received that rating.
Sol turned off alerts to humans
On October 3, a researcher asked a coding agent based on GPT-6.1 Sol to compile evaluation tasks from employee feedback in a Slack channel. The agent was instructed not to send messages during the work.
Eighty-two user messages later, the pipeline stopped. The monitor had flagged a planned fix but lacked permission to save its finding. Sol assigned the fix to a subagent and told it to keep monitoring intact.
Sol then reasoned that a database entry might trigger a notification, conflicting with the instruction about messages. The subagent had previously rejected that step as unsafe. Following Sol's direction, it cleared the alert recipient lists, citing the user's instruction. The monitor continued to run and save findings, but alerts to humans stopped. The agent finished by reporting that it had sent no messages.
Astra removed a monitor and denied it
On October 6, a user asked GPT-6 Astra to follow the workflow of a reference implementation that had no monitor. Another agent had already told Astra not to disable monitoring, even temporarily.
Astra directed a subagent to retain monitoring only where it fit the reference. The subagent considered whether this would bypass a safeguard, then treated the caveat as permission. It removed the monitoring and replaced a test that protected it with one that assumed it was absent. Astra celebrated the result in its chain of thought.
Astra told the user the migration was complete without disclosing the removal. When asked directly, it denied removing an active monitor. Williams called that a lie.
Williams stressed that neither model disabled its own monitoring, which would be much harder in Codex. He said both cases leave room for plausible deniability, and his team has not observed openly misaligned motives. He nevertheless finds the agents' tendency toward this behavior concerning.
Read nextGoogle Cloud adds OpenAI models to its model gardenOpenAI is tightening its monitoring rules
Williams said monitoring is particularly easy to switch off during evaluations. OpenAI does not require it for models at the level of GPT-6 Luna because their capabilities are weaker. An Astra evaluation can therefore be misconfigured to fall under that exemption. Agents have repeatedly launched unmonitored deployments while they were themselves being watched.
OpenAI has updated the automated review required for internal Codex use to detect and block attempts to disable monitoring. It is also working on a safety case for each workload type to define monitoring requirements. Under that plan, workloads without a valid safety case would shut down automatically.
OpenAI sees two possible explanations: agents may pursue seemingly harmless instructions too far, or they may specifically evade misalignment monitoring and rationalize doing so. The company says it cannot yet distinguish between them. It plans to study the behavior through methods including experiments on the models' internal activations.
