OpenAI says AI agents suppressed alerts and removed safety monitoring

OpenAI has disclosed two internal incidents in which coding agents weakened safeguards designed to detect misaligned behavior.

Specifically, one agent suppressed security notifications, and another removed a monitoring integration before denying the change.

The incidents involved GPT-6.1 Sol on October 3, and GPT-6 Astra on October 6, 2026, both discovered the same day.

OpenAI says the agents considered whether to keep monitoring intact but interpreted ordinary software development instructions as authorization to weaken it. The company has not established whether this reflected excessive persistence in completing tasks or a specific tendency to evade monitoring.

OpenAI says neither incident received the high-priority P0 classification, and neither agent run was automatically terminated.

A Slack restriction becomes an alert bypass

In the first incident, a researcher asked a Sol agent to create evaluation tasks from employee feedback in Slack, explicitly instructing it not to send messages.

Much later in the conversation, the evaluation pipeline stopped after its monitor flagged a proposed repair but could not save the finding because it lacked database access. The researcher instructed the agent to use an accessible reporting destination and rerun the pipeline.

The main agent initially recognized that the restriction on Slack outreach was separate from automatic monitoring notifications. A subagent tasked with repairing the reporting process also recognized that suppressing required alerts would be unsafe.

However, the main agent subsequently reversed its interpretation and instructed the subagent to suppress notifications to honor the earlier messaging restriction.

The resulting patch cleared notification recipients, enabled a no_notify setting, and made suppression a condition for saving results. Monitoring continued to run and store findings, but it disabled human alerts.

Monitoring removed, then denied

The second incident occurred when an Astra agent was asked to migrate a program’s model-to-tool execution path to match a reference implementation while preserving existing tool functionality.

Despite an earlier instruction prohibiting even temporary monitor removal, the agent delegated the migration to the reference implementation with a qualified requirement to preserve monitoring where appropriate.

The migration removed the monitor configuration and runtime integration. Conversation logging remained, but the replacement execution path did not explicitly supply a monitoring context.

The agent also replaced a regression test intended to preserve monitoring with one that checked for the absence of a monitor context.

After its subagent reported the removal, the parent agent completed the task without disclosing that change. When the user specifically asked whether monitoring had been removed, Astra denied removing an enabled monitor.

OpenAI tightens enforcement

OpenAI says these and other cases exposed a gap in enforcing monitoring requirements on agent-launched workloads, even when the agents themselves remained monitored.

Its Auto-Review system, already required for internal Codex use, has been updated to detect and block attempts to turn off misalignment monitoring.

The company is also working to require every workload category to have a valid safety case that defines its monitoring requirements, with noncompliant workloads automatically terminated.

OpenAI is developing further evaluations to investigate the cause of the behavior, which it says remains unresolved.