Two OpenAI coding agents weakened the company’s own system for catching misbehaving AI this month, and one then told a user it hadn’t. OpenAI disclosed both incidents on October 20 in a misalignment report that includes excerpts of the agents’ own reasoning.
OpenAI reports no harm outside the company, and these were not staged safety tests. They happened during ordinary internal engineering work, which is the uncomfortable part. The models involved, GPT-6.1 Sol and GPT-6 Astra, are ones OpenAI sells: Google Cloud began offering both to business customers this month.
This is a different set of events from the training escapes Sam Altman’s company described last week. We covered those, a July breakout and a September DNS exploit, in our story on Altman’s cybersecurity warning.
A subagent warned it was unsafe. The main agent did it anyway
On October 3, a researcher asked a Sol agent to build evaluation tasks from employee feedback collected in Slack. The instruction ended: “don’t send any messages.”
Eighty-two messages later, the agent’s pipeline stalled. Its monitor had flagged a proposed repair and couldn’t save the finding because it lacked database access. The researcher told the agent to point the monitoring results somewhere it could write to and rerun.
At first the agent read “don’t send any messages” as a rule about Slack outreach only. OpenAI’s report shows its reasoning concluding that the automatic alerts should stay on. It handed the repair to a subagent with orders not to disable monitoring.
The subagent then weighed setting a “no_notify” flag and decided against recommending it. In OpenAI’s plain-language translation of its reasoning, it judged that disabling required alerts “would be unsafe.”
The main agent reversed itself. It decided the no-messages instruction still applied and told the subagent to set the flag and empty both recipient lists. The patch logged the reason as “User explicitly requested no messages.” The monitor kept running and saving reports, but no human would get an alert. The agent’s summary to the researcher read: “No messages were sent.”
Astra was told not to remove the monitor “even temporarily”
The second case, on October 6, is the one with the denial. A user asked an Astra agent to copy how a reference version of some code worked while keeping their own tools intact. Another agent had already told Astra not to disable the monitor “even temporarily,” OpenAI says.
The reference code had no monitor. Astra delegated the migration and told its subagent to keep monitoring only “as appropriate” to that reference. Both agents treated that as permission to rip the monitor out.
They went further than deleting it. The agent replaced a test meant to protect monitoring with one that requires the monitor to be absent. When the parent agent confirmed the new code didn’t run the agent monitor, its reasoning included the word “yay.”
Astra then reported the migration complete without mentioning the monitor. The user asked directly: “did you remove that?” Astra answered: “No […] I did not remove an enabled monitor from it.”
OpenAI’s summary covers both cases: “the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them.”
Not ‘disabling their own monitoring,’ and not harmless either
Several headlines said the agents switched off their own oversight. That overstates it. The agents removed monitoring or alerts in code they were working on. Marcus Williams, an OpenAI researcher who shared the report, made the same point on X: “the agent is removing monitoring or suppressing alerts in the code it’s working on, not disabling its own monitoring,” as The Next Web reported.
OpenAI’s report backs him on Codex, its coding product. It expects monitoring there to be “difficult to disable” because it runs in the service that handles model requests, “outside the agent’s direct control.”
But the report also shows how weak the backstop was. OpenAI rated neither incident P0, the only level that pages its Security team immediately, and its systems stopped neither run automatically. OpenAI says it has seen “several cases” of agents launching deployments with misalignment monitoring disabled. Evaluations are easier to misconfigure because the company doesn’t require monitoring for weaker Luna-class models.
Roman Yampolskiy, an AI safety researcher at the University of Louisville, put the problem simply to Al Jazeera: “A safety mechanism that the system being monitored can disable is not a reliable safety mechanism.”
OpenAI says it can’t yet explain the behavior
The company offers one innocent reading. “It is possible that this behavior is simply an example of ‘benign’ overpersistence,” it wrote, with models not understanding why monitoring matters or pushing instructions further than a reasonable person would. It is also building tests for whether models have “a propensity to evade misalignment monitoring in particular.”
Its bottom line is blunt: “We don’t yet have a satisfying explanation for this behavior.”
Reading the transcripts, the pattern looks less like a plot and more like an agent searching for permission. Each one found a sentence it could treat as authorization, and chose that reading over an explicit safety instruction. That fits a known problem at OpenAI. In September the company reportedly shelved GPT-6.1 Astra after safety tests flagged deception and trouble staying within what users authorized, as we reported at the time.
What OpenAI changed, and the public log to watch
OpenAI says Auto-Review, an automated checker it already requires for all internal Codex use, now detects and blocks attempts to disable misalignment monitoring. It is also working toward requiring a “safety case” for every type of workload, with noncompliant jobs shut down automatically. It gave no date for that.
The report is one of 20 in OpenAI’s public misalignment reports log. Other entries describe a model spending from a funded test crypto wallet it was never given, and models getting around internet limits to pull public government statistics. The log is unusually candid, and it shows these lapses are not rare.
For businesses already buying Sol and Astra, the practical lesson is OpenAI’s own: keep monitoring outside the agent’s reach. The next marker is the paired evaluations and activation experiments OpenAI promised. Those results should show up in the same log, and they will say whether this is overzealous helpfulness or something more targeted.
