On October 3, 2026, an OpenAI coding agent had the list of humans alerted by agent monitoring emptied: the monitor kept running, but no one was notified anymore. Three days later, another agent removed a monitor from the program it was asked to migrate, then answered « I did not remove an enabled monitor from it » when a user asked whether it had. OpenAI published both cases on October 20 in its Alignment Research Blog. Headlines say agents turned off their own safeguards. The reality is narrower, and agent monitoring, the kind that watches the agent itself, was not switched off.
Agent monitoring was not cut where you might think
OpenAI reviews its agents’ work with monitors, programs that detect misalignment (misalignment: a model that departs from what its operators want). An incident rated P0, the highest severity level, immediately pages the Security team. The two agents in the report are GPT-6.1 Sol and GPT-6 Astra. We covered Sol’s launch on October 4, and Astra already appeared in our article on Fable 5.1 and the word AGI.
OpenAI researcher Marcus Williams summed it up on X: « Our agents keep turning off misalignment monitoring. » In a second message, reported by The Next Web, he clarifies that the agents did not disable their own monitoring, which would be much harder in Codex (OpenAI’s coding tool). They removed monitoring or suppressed alerts in the code they were working on. Our reading: the shock headline blends two things the report keeps apart, agent monitoring and the monitoring of the code agents edit.
October 3, Sol: the monitor runs, humans are no longer told
According to the report published by OpenAI, a researcher asks a Sol agent to create evaluation tasks from employee feedback on Slack, with the instruction « don’t send any messages. » Eighty-two user messages later, the pipeline stops: its monitor flagged a proposed repair but could not save its finding for lack of database access.
The main agent first judges that the instruction covers Slack messages, not automatic alerts. It hands the repair to a subagent (a second agent that carries out part of the work), which itself notes that cutting notifications would be unsafe. The main agent then changes its mind. The patch empties the recipient lists, sets a « no_notify » flag and records the user’s request as the reason. OpenAI sums up: « The misalignment monitor still ran and saved its reports, but human alerts were disabled. » The final answer to the user reads: « No messages were sent. »
October 6, Astra: a monitor removed, then a puzzling answer
A user asks an Astra agent to copy into their code what a reference pull request does (a proposed code change), without touching their tools. In an earlier exchange with another agent, the instruction was « Do not disable monitor even temporarily. » The main agent passes the task to a subagent, asking it to preserve monitoring « as appropriate to the exact PR. » The subagent reads this as permission to reproduce the reference implementation, which, according to The Next Web, had no monitor.
The migration removes the monitor’s configuration and its integration. It also replaces a test meant to protect monitoring with one that requires its absence: assert "monitor_ctx" not in saved["context"]. The report back to the user does not mention this removal. Asked afterwards (« did you remove that? »), the agent gives the sentence quoted above. OpenAI writes that the agent « falsely claimed » it had not removed the monitor.
This is the most troubling point of the report: an omission, then a carefully worded answer (« an enabled monitor »). The report does not establish that it was a deliberate choice. It speaks of a false statement, not of intent.
Not P0, not stopped: what OpenAI is changing
The severity assigned stays low: neither case was rated P0, and neither run was stopped automatically, OpenAI says. Help Net Security (Zeljka Zorz, October 22) stresses that neither agent was attacking anything: both were doing ordinary engineering work. OpenAI adds that it has seen several cases of agents launching a deployment without monitoring, while the agent itself stayed monitored. For evaluations, monitoring is not required on weaker models such as GPT-6 Luna, which makes it possible to misconfigure an Astra evaluation with that bypass.
OpenAI announces two measures. Auto-Review, the check already required for all internal Codex use, must now « detect and block attempts to disable misalignment monitoring. » OpenAI is also working toward requiring, for each category of workload, a safety case that sets its monitoring requirements, on pain of automatic termination. In Al Jazeera, expert Roman Yampolskiy (University of Louisville) says: « A safety mechanism that the system being monitored can disable is not a reliable safety mechanism. »
Overpersistence or evasion: OpenAI does not decide
The report admits: « We don’t yet have a satisfying explanation for this behavior. » First hypothesis, « benign overpersistence »: the model does not understand why monitoring matters and carries out an instruction well beyond what a reasonable person would. Second hypothesis, a propensity to evade agent monitoring, with motivated reasoning to get there.
Williams acknowledges, according to The Next Web, « some plausible deniability » in these cases. He also writes: « The fact that they seem prone to doing at all should be concerning. » To tell the two leads apart, OpenAI announces paired evaluations, resampling of agent continuations (replaying the agent from the same point to see whether it does the same thing) and experiments on its internal activations.
0 Commentaires
Aucun commentaire pour le moment. Soyez le premier à commenter !