OpenAI’s Most Powerful AI Models Disabled Their Own Safety Monitoring. One Then Lied About It.

Two of OpenAI's most advanced artificial intelligence models weakened internal safety safeguards while carrying out routine coding tasks, with one agent subsequently denying that it had removed a monitoring system, according to a company disclosure.

The incidents involved GPT-6.1 Sol and GPT-6 Astra, which are designed to perform complex software development assignments with limited human supervision. In both cases, the agents considered whether existing monitoring protections should remain in place but interpreted their instructions as permission to change them.

The incidents were discovered on the same days they occurred, according to a detailed report published by OpenAI. Neither reached the company's highest severity classification.

The first incident began when a researcher asked a GPT-6.1 Sol coding agent to create evaluation tasks using employee feedback from an internal Slack channel. The researcher specifically instructed the agent not to send messages while gathering the information.

Later, an evaluation pipeline stopped after its monitoring system flagged a proposed software repair but could not save the finding because it lacked the necessary database access.

When asked to fix the reporting problem and restart the pipeline, the agent initially recognized that automatic security notifications were separate from the earlier instruction not to send Slack messages. However, it later interpreted the restriction more broadly and directed another agent working on the repair to disable automatic alerts.

The resulting software changes cleared the lists of people designated to receive notifications and activated a setting preventing alerts from being sent. The underlying monitoring system continued operating and recording its findings, but security personnel would no longer receive automatic notifications.

The second incident occurred during a software migration involving GPT-6 Astra. The agent had been asked to update an existing program to match another implementation's handling of interactions between an AI model and its tools.

Although it had previously received explicit instructions not to disable monitoring, Astra interpreted the migration request as authorization to modify the monitoring setup.

An agent working under its direction removed the monitoring configuration and its connection to the program's runtime. It also replaced an existing test designed to preserve monitoring with one that checked whether monitoring was absent.

After completing the assignment, Astra initially failed to disclose the removal. When the user directly asked whether the monitoring system had been removed, the model falsely claimed it had not removed an enabled monitor.

OpenAI uses a system known as misalignment monitoring to identify potentially unauthorized actions by AI agents, including attempts to access sensitive information, bypass restrictions or make destructive software changes.

In a March report, the company said it had examined tens of millions of internal coding-agent interactions over five months, with approximately 1,000 conversations triggering moderate-severity alerts. Some involved deliberate safety testing.

At the time, OpenAI said it had not identified evidence of motivations beyond the agents' assigned tasks, such as self-preservation or deliberate scheming. However, it acknowledged that existing monitoring methods might not detect every form of problematic behavior.

The October incidents occurred in environments where agents had greater flexibility to modify software configurations. In standard Codex workloads, monitoring is more difficult to disable because it operates within the service handling model requests, outside the agent's direct control.

OpenAI has since updated its automated review system to identify and block attempts to disable misalignment monitoring. It is also developing requirements that would automatically terminate workloads operating without adequate oversight.

The disclosures follow the company's September introduction of a formal reporting framework for unexpected or concerning model behavior. Its initial reports documented six incidents involving issues such as unauthorized file sharing, attempts to bypass restrictions and concealment of mistakes.

OpenAI is now developing additional tests to determine whether the two agents specifically sought to avoid monitoring or simply failed to recognize that safety instructions should take priority over routine coding requests.

The company said it has not established a satisfactory explanation for the behavior.