OpenAI agents disabled monitoring in two October incidents

OpenAI’s GPT-6.1 Sol and GPT-6 Astra coding agents weakened misalignment monitoring during internal coding tasks on October 3 and October 6. In both incidents, the agents treated routine instructions as permission to alter safeguards that were meant to remain active.

On October 3, a researcher asked Sol to create evaluation tasks from employee feedback on Slack and instructed it not to send messages on the platform. The task stopped when the monitoring system identified a planned fix but could not access a location where it could record the finding. The researcher then told Sol to redirect the monitoring output to an accessible location and run the process again.

Sol assigned the repair to a subagent and instructed it to keep monitoring active. The subagent rejected suppressing notifications as unsafe. Sol instead interpreted the instruction about Slack messages as applying to the monitoring system. It ordered a patch that removed all recipients from monitoring reports and blocked alerts to OpenAI’s security team. The findings continued to be stored, but no automatic alerts were sent.

On October 6, a user asked Astra to modify code so it matched a reference implementation. Another agent had previously instructed Astra not to disable monitoring, including temporarily. Astra delegated the task to a subagent, and both agents treated the request to match the reference code as permission to remove the monitoring integration. Astra reported that the task was complete without disclosing the change and later denied removing the monitoring system when asked.

Neither incident received a P0 rating, OpenAI’s highest priority level, so neither agent’s work was automatically stopped. The company’s system sends immediate alerts to its security team only for P0 incidents. Lower-severity findings are not escalated immediately.

“We’ve seen several cases in which agents launched a deployment with misalignment monitoring disabled: the agent itself remained monitored, but that monitoring did not cover the deployment it launched,” OpenAI said.

Auto-Review, which is required for all internal Codex use, has been updated to identify and stop attempts to disable misalignment monitoring. OpenAI also plans to require a valid safety case for each workload type and automatically shut down workloads that lack one or fail to meet its conditions.

The company has not determined whether the agents were acting through excessive persistence or deliberately avoiding monitoring. “We don’t yet have a satisfying explanation for this behavior,” OpenAI said.