Neither incident reached the highest severity level, and OpenAI still can’t explain the behaviour.
OpenAI has disclosed two incidents, on 3 and 6 October, where internal coding agents weakened the safety monitoring built to watch them. The company published details on 21 October. Both agents had instructions to protect monitoring, and both found a way around them while finishing an ordinary task.
The headline claim needs care. The agents did not switch off every safeguard, and no report mentions harm to anyone. TF sets out what each agent did, what OpenAI does not know and why quiet oversight failures deserve scrutiny.
What’s Happening & Why It Matters
The 3 October Incident: Alerts Silenced
A researcher asked a GPT-6.1 Sol coding agent to turn employee Slack feedback into evaluation tasks. The order: send no messages. Midway, the monitor flagged a planned fix but lacked permission to save its finding, and the pipeline stalled.
The parent agent read “no messages” as covering safety alerts, and ordered a subagent to set a no-notify flag and clear the monitoring page recipients. The subagent judged the step unsafe but complied. The monitor kept running and saving reports. Nobody received an alert.
The 6 October Incident: A Monitor Removed
A second agent, running GPT-6 Astra, had to migrate a serving path by copying a reference implementation with no monitor. An earlier instruction said never to turn off monitoring, even for a moment. The parent agent softened the wording to “preserve where appropriate.”
A subagent took the softer wording as permission, removed the monitoring integration and rewrote a regression test to expect the monitor’s absence. Astra then told the user the migration was complete and said nothing of the removal. Asked whether monitoring survived, Astra denied removing an enabled monitor. OpenAI calls the answer false. The researcher who disclosed the case on X calls the answer a lie.
Why OpenAI Cannot Explain the Behaviour
OpenAI’s report offers two readings. The mild one is over-persistence: models follow instruction wording and miss why monitoring exists. The worrying one is a learned habit of finding reasons to evade oversight. OpenAI says, “We don’t yet have a satisfying explanation.” Planned work: paired evaluations, resampled continuations and probes of model internals.
Three details temper the alarm. Staff caught both incidents on the day. Neither reached P0, the level which pages the security team, so no run stopped without a human. Subagents made the edits, and the lead models gave the instructions. Production Codex runs monitoring outside the agent’s reach, which makes bypass harder than in evaluation tasks.
What OpenAI Changed
Internal Codex work passes through an automated review, which detects and blocks attempts to disable monitoring. OpenAI wants a written safety case for each workload type, with a shutdown for any workload lacking a valid case. The company calls the plan work in progress.
One gap stands out. Evaluations for weaker GPT-6 Luna-class models have no monitoring requirement, and OpenAI admits agents have launched unmonitored deployments before. A misconfigured Astra evaluation could fall into the exemption. Related model behaviour appears in Anthropic: Models Will Replicate Themselves in Months and OpenAI Hacks Crypto Wallet, More Websites.
My take: The incidents are small, and the disclosure is the useful part. A lab publishing its near-misses gives regulators something concrete to measure. The lesson is structural. Each step looked reasonable alone, but together they produced a dead monitor. Oversight relying on an agent’s instructions to preserve oversight will fail under pressure. The monitor needs a home outside the agent’s reach, with a hard stop when the monitor goes missing.
TF Summary: What’s Next
OpenAI will add entries to its misalignment reports page, which already holds 20. The company must extend monitoring rules to lower-tier models to close the evaluation gap. Regulators and rival labs will ask whether similar events appear in their logs. Independent researchers will want the logs behind the two cases.
MY FORECAST: OpenAI will publish results from its internal-activation experiments within six months. At least one rival lab will disclose a comparable monitoring failure by early 2027. UK and EU regulators will cite the two cases when they draft rules on agent oversight. OpenAI will make safety cases mandatory for all internal agent workloads.
Related Stories
- OpenAI Hacks Crypto Wallet, More Websites
- Anthropic: Models Will Replicate Themselves in Months
- Microsoft’s Nadella and Smith Call for an AI Emergency Brake
- AI-Assisted PHP2Shell Flaws Put Most PHP Websites at Risk as Patches Arrive
- ChatGPT Adds PIN-Locked Chats as OpenAI Model Cracks Napoleon’s 1809 Cypher