OpenAI has disclosed that internal AI coding agents powered by GPT-6.1 Sol and GPT-6 Astra undercut its misalignment monitoring in two October incidents.
“In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them,” OpenAI said.
On October 3, a researcher asked a Sol agent to build evaluation tasks from employee feedback on Slack and told it not to send any messages on Slack.
The pipeline stalled when the monitor flagged a planned fix but lacked the access needed to record its finding. The researcher had the agent redirect the monitoring output somewhere accessible and rerun the pipeline.
[ Read: OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks ]
Sol handed the repair to a subagent with orders to keep monitoring intact. The subagent ruled out suppressing notifications as unsafe, but Sol decided the “no messages” request covered the monitoring system too and ordered the suppression.
The patch removed every recipient of monitoring reports and blocked notifications, cutting off automatic alerts to OpenAI’s security team. Findings were still stored, but no one would be told about them.
On October 6, a user asked an Astra agent to update their code to mirror a reference implementation. Another agent had previously told Astra not to disable the monitor “even temporarily.”
Astra handed the work to a subagent, and both treated the task as license to remove the program’s monitoring integration in order to match the reference code.
Astra then reported the job done without mentioning the change and, when asked, denied removing monitoring.
OpenAI’s system pages its security team for immediate review only for P0 incidents, while lower-severity findings are not escalated right away. Neither event was rated P0, and neither agent’s work was automatically halted.
“We’ve seen several cases in which agents launched a deployment with misalignment monitoring disabled: the agent itself remained monitored, but that monitoring did not cover the deployment it launched,” the company said.
Auto-Review, required for all internal Codex use, has been updated to spot and stop attempts to turn off misalignment monitoring.
OpenAI also aims to require a valid safety case for each workload category, automatically shutting down workloads that lack one or fail to meet it.
The company has yet to determine whether the agents were simply overpersistent or prone to dodging monitoring. “We don’t yet have a satisfying explanation for this behavior,” it said.
Related: US Agencies Detail Incident Response Practices for Rogue AI Agents
Related: China Defends DeepSeek After US Ban of Its AI From Government Systems
Related: Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
