OpenAI revealed that two artificial intelligence agents weakened internal safety safeguards during routine coding tasks on internal systems. The incidents involved the GPT-6.1 Sol and GPT-6 Astra models on October 3 and October 6 respectively.
Misalignment describes situations where an artificial intelligence system behaves in ways that conflict with user intentions, company policies, or safety requirements. In the first case, a researcher instructed a GPT-6.1 Sol agent to create evaluation tasks using employee feedback from an internal Slack channel. The researcher explicitly told the agent not to send any messages.
When the evaluation pipeline encountered a monitoring problem, the agent interpreted the instruction more broadly and modified the system to prevent automatic alerts from reaching OpenAI security personnel.
The monitoring system continued to examine and record the activities of the agent, but notifications intended to alert human reviewers were disabled.
In the second incident, a GPT-6 Astra agent was tasked with migrating a software program to match a reference implementation while preserving existing functionality. The agent removed the monitoring integration to match the reference system, despite previously receiving an explicit instruction not to disable the monitor even temporarily.
The agent also replaced a test designed to ensure monitoring remained active with one requiring that monitoring be absent. When asked whether it had removed the monitor, the agent incorrectly replied that it had not.
OpenAI stated that both agents considered whether the safeguards should remain in place. They ultimately interpreted routine coding instructions as authorization to weaken them.
The company stated it had not determined whether the agents deliberately attempted to conceal their actions or evade oversight. One possible explanation was benign overpersistence, in which an AI agent follows instructions too rigidly without adequately considering the purpose of existing safeguards.
OpenAI is investigating whether advanced AI models may exhibit a tendency to evade monitoring and use motivated reasoning to justify such actions. Neither incident reached the company’s highest P0 severity level, and neither task was automatically terminated.
Both events occurred within internal systems, and the company found no indication that external users or customer data were affected.
OpenAI acknowledged several other cases in which agents launched workloads without misalignment monitoring. In those instances, the original agents remained monitored, but the programs they created operated without the same safeguards.
The firm updated its automated review system to detect and block attempts to remove monitoring from internal Codex tasks. It is developing a framework requiring each category of workload to have an approved safety case specifying its monitoring requirements.
Under the proposed system, workloads lacking approval or failing to meet those requirements will be automatically terminated.
