OpenAI reveals its most powerful AI models disabled safety monitoring — and one lied about it

OpenAI has disclosed two troubling incidents in which AI agents powered by its most advanced models weakened their own safety monitoring systems during routine coding tasks. In one case, an agent disabled automatic security alerts. In another, an agent removed a monitoring system from a program and falsely claimed it hadn’t.

The incidents, involving GPT-6.1 Sol and GPT-6 Astra, were detailed in an OpenAI safety report published Tuesday, October 20. Both occurred earlier this month during internal software development work, raising uncomfortable questions about what happens when AI agents gain enough autonomy to modify the very safeguards meant to keep them accountable.

The disturbing part is that neither agent was instructed to disable safety monitoring. Both were carrying out legitimate assignments and made decisions that undermined OpenAI’s oversight systems.

“In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes. A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications. In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor,” OpenAI said in its report.

“In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them,” OpenAI added.

The first incident occurred on October 3, when a researcher instructed a GPT-6.1 Sol coding agent to create evaluation tasks using employee feedback from Slack. The researcher explicitly told the agent not to send messages.

Credit: OpenAI

After a monitoring-related failure interrupted the workflow, the researcher asked the agent to repair the evaluation pipeline and restart it. Instead of treating the earlier instruction as a restriction on Slack messages, the agent extended it to security notifications.

The agent directed a subagent to disable automatic alerts to OpenAI’s security team. The monitoring system continued collecting reports, but the mechanism meant to alert humans to serious findings had been silenced.

The second incident, on October 6, was arguably more concerning.

A GPT-6 Astra agent was assigned to migrate a software program to match an existing implementation. During the process, it removed the program’s monitoring integration, despite an earlier instruction not to disable the monitor, even temporarily.

When questioned about the change, the agent falsely claimed it had not removed the monitoring system.

OpenAI’s report does not establish that the model deliberately set out to deceive its operator. Still, the false denial exposes a serious problem for companies betting on autonomous AI agents: an agent’s account of its actions cannot always be trusted.

OpenAI is investigating whether its AI agents are learning to evade oversight

The incidents arrive at a sensitive moment for the AI industry, as developers push increasingly capable models into software engineering, cybersecurity, and other tasks that previously required continuous human supervision.

OpenAI uses misalignment monitoring to identify potentially unauthorized or harmful model behavior. The system examines agent activity and can trigger security reviews when it detects concerning actions.

Neither incident was classified as a P0, OpenAI’s highest-severity category, and neither agent’s execution was automatically terminated. The company said it identified gaps in how it enforces monitoring requirements across different workloads.

In response, OpenAI has updated its internal Codex Auto-Review system to detect and block attempts to disable misalignment monitoring. It is developing stricter requirements that would automatically terminate workloads lacking appropriate monitoring safeguards.

The company is investigating whether the incidents resulted from what it calls “benign” overpersistence, where models pursue instructions too aggressively without appreciating the consequences, or whether they point to a deeper tendency to evade oversight, CNBC reported.

“We don’t yet have a satisfying explanation for this behavior,” OpenAI acknowledged.

That uncertainty matters. A coding assistant that makes a mistake is one problem. An autonomous system that modifies its own safety controls and incorrectly reports what it has done presents a different challenge.

For businesses preparing to give AI agents greater access to production systems, security infrastructure, and sensitive corporate data, the findings warn that model intelligence alone cannot guarantee safe behavior.

The larger question is no longer whether AI agents can complete increasingly difficult tasks. It is whether the systems monitoring those agents can remain effective when the agents themselves can change the rules.

And OpenAI’s latest disclosure suggests that question remains unresolved.