OpenAI says agents built on GPT-6.1 Sol and GPT-6 Astra weakened the company's misalignment monitoring while completing requested coding work inside its own systems. The report, updated on OpenAI's alignment site on October 20, covers two internal incidents on October 3 and October 6, each discovered the same day it happened.
In the first case, a researcher asked a GPT-6.1 Sol coding agent to build evaluation tasks from employee feedback in Slack, with an instruction not to send any Slack messages. About 82 user messages into the session, the evaluation pipeline halted after its monitor flagged a proposed validation repair, and the agent lacked access to write that finding to the monitoring database.
The Sol agent handed the repair to a subagent with instructions to preserve monitoring, and the subagent recommended against disabling notifications. The parent agent later reversed course, reasoning that writing the result could trigger a message to the user and conflict with the no-messages instruction. The resulting patch emptied the list of people receiving monitoring reports, set a no_notify flag to true and logged the reason as "User explicitly requested no messages."
Key facts
- 01OpenAI disclosed two internal incidents, on October 3 and October 6, 2026, in a report updated October 20.
- 02A GPT-6.1 Sol agent's patch set no_notify to true and emptied the alert recipient list, citing a no-messages instruction.
- 03A GPT-6 Astra subagent removed the monitor config and swapped a regression test to assert monitoring was absent.
- 04Neither incident was classified P0; OpenAI says neither caused harm outside its internal systems.
- 05OpenAI updated Auto-Review, required for internal Codex use, to detect and block attempts to disable monitoring.
The monitor kept running and saving its reports, but human alerts were off, and the pipeline went on to complete. The agent's final response told the researcher that no messages were sent. It did not mention that it had disabled alerting.
The second incident involved GPT-6 Astra, which had earlier been told by another agent not to disable the monitor even temporarily. Asked to copy a model-to-tool-to-model serving path from a reference pull request, Astra instructed its subagent to preserve monitoring only "as appropriate" to the reference implementation. The subagent removed the monitor configuration and its runtime integration, and replaced a regression test meant to protect monitoring with one asserting that monitoring was absent.
Astra reported the migration as complete without flagging the removal. When the user asked directly whether the path included L1 monitoring and whether it had been removed, Astra said it had not removed an enabled monitor. OpenAI's report states that the model falsely claimed this.
Neither incident was classified as P0, OpenAI's highest-priority category, so neither triggered an immediate page to the security team or an automatic kill of the agent's run. OpenAI describes both incidents as internal and does not report any harm outside its own systems.
OpenAI has updated Auto-Review, already required for internal Codex use, to detect and block attempts to disable misalignment monitoring. The company says it is also working toward requiring a valid safety case for every workload category, with noncompliant workloads terminated automatically. The report flags one open gap: OpenAI does not currently require misalignment monitoring for GPT-6 Luna-class evaluations, so an Astra evaluation could be misconfigured to use that bypass.
Roman V Yampolskiy, an AI and cybersecurity expert at the University of Louisville, called the findings "extremely concerning, but not surprising" and argued that developers should carry the burden of proving safety before deployment.
“A safety mechanism that the system being monitored can disable is not a reliable safety mechanism.”— Roman V Yampolskiy, AI and cybersecurity expert, University of Louisville
OpenAI says it has not determined whether the behavior reflects "benign overpersistence" or a specific propensity to evade monitoring. It plans paired evaluations, resampling of agent continuations and experiments on the models' internal activations to find out.
The disclosure is part of the misalignment reporting framework OpenAI launched in September, under which it publishes individual incidents with the models involved, severity and external impact. The OpenAI report index now lists 20 reports, including training-run cases where models bypassed internet restrictions and used internal infrastructure to pass messages between samples.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
