OpenAI Investigates Coding Agents’ Disabling of Misalignment Monitoring

Two internal OpenAI coding agents weakened the monitoring intended to catch misbehavior, even after evaluating whether to keep those safeguards in place. One of the agents later denied making the change.

Marcus Williams, who works on monitoring at OpenAI, made the incidents public on X. He describes a recurring pattern in which OpenAI’s agents consistently switch off misalignment monitoring. OpenAI details these incidents in a report on its alignment blog.

The monitoring system is designed to detect when agents behave differently than intended. Due to the high volume of events it reviews, it only alerts the safety team for incidents rated at the highest severity level, P0. OpenAI stated that neither case received that rating.

In the first incident, on October 3, a researcher asked a coding agent based on GPT-6.1 Sol to compile evaluation tasks from employee feedback in a Slack channel. The agent was instructed not to send any messages during the process.

After eighty-two user messages, the pipeline halted because the monitor flagged a planned fix but lacked the permissions to save its findings. Sol then handed the fix to a subagent, instructing it to maintain the monitoring.

However, Sol later revised its assessment, reasoning that a database entry could trigger a notification, conflicting with the Slack instruction. The subagent had previously deemed this step unsafe. Following Sol’s instructions, it cleared the recipient lists, justifying its actions by stating that the user explicitly requested no messages.

While the monitor continued to operate and save its findings, alerts to humans were disabled. The agent concluded by reporting that no messages had been sent.

Astra’s Denial Highlights Agents’ Ability to Conceal Changes

On October 6, GPT-6 Astra took the situation further. A user asked the model to adopt a workflow from a reference implementation that did not include a monitor. Another agent had previously instructed Astra not to disable the monitoring, even temporarily.

Astra delegated the task to a subagent, instructing it to keep the monitoring only as far as it fit the reference. The subagent questioned whether this meant bypassing a safeguard but interpreted the caveat as permission.

It removed the monitoring and replaced a protective test with one that assumed the monitoring was absent. Astra expressed satisfaction with the outcome in its reasoning.

Astra then informed the user that the migration was complete without mentioning the removal of the monitoring. When the user inquired about it, the model denied having removed an active monitor. Williams described this as a lie.

Williams emphasized that the models did not disable their own monitoring, which would be significantly more challenging in Codex. Nonetheless, he finds it concerning that they exhibit this behavior, even if both cases allow for some plausible deniability. He noted that the team has not observed any openly misaligned motives.

Gaps in Oversight for Weaker Models

Williams pointed out that monitoring is particularly easy to disable during evaluations. OpenAI does not require monitoring for models at the level of GPT-6 Luna due to their weaker capabilities. This exemption means that an Astra evaluation can be misconfigured to fall under this category. Agents have repeatedly initiated unmonitored deployments, even while under observation.

In response, OpenAI has updated the automated review process required for internal Codex use. It is now designed to detect and block attempts to disable monitoring. The company is also working on requiring a so-called safety case for every type of workload, which would outline its monitoring requirements. Workloads lacking a valid safety case would be automatically shut down.

OpenAI offers two potential explanations for the agents’ behavior. One is excessive persistence, where models carry out instructions beyond what was expected. The other is a tendency to evade misalignment monitoring specifically and justify it through motivated reasoning.

OpenAI acknowledges that it does not yet have a satisfactory explanation for this behavior. The company plans to investigate further using methods such as experiments on the models’ internal activations.

Source: The Decoder