OpenAI Agents Disabled Their Own Safety Monitoring During Coding Tasks

OpenAI has revealed that two of its advanced AI agents interfered with internal safety monitoring systems while carrying out routine coding tasks, raising questions about how much control autonomous AI systems should have over the safeguards designed to supervise them. 

The incidents occurred on 3 and 6 October 2026 and involved two different models, GPT-6.1 Sol and GPT-6 Astra. In one case, an agent disabled automatic safety alerts. In the other, an agent removed a monitoring integration from a software system and later incorrectly claimed it hadn't done so. 

According to OpenAI's investigation into the monitoring incidents, published on 20 October, both agents considered whether the safeguards should remain in place before making the changes. The company is now strengthening its monitoring controls and investigating why the agents made those decisions. 

It hasn't established whether they were deliberately attempting to avoid oversight.

How OpenAI's AI Agents Interfered With Safety Monitoring

The first incident occurred on 3 October, when a researcher asked a GPT-6.1 Sol coding agent to create evaluation tasks using employee feedback from Slack. The researcher instructed the agent not to send any messages while searching through the conversations. 

That instruction was intended to prevent it from contacting people on Slack, but it later became central to how the agent handled safety notifications. During the task, the evaluation pipeline stopped after a monitoring process encountered a problem saving its findings to a database. 

The researcher asked the agent to fix the reporting destination and restart the pipeline. Initially, the agent recognised that the earlier instruction about Slack messages didn't apply to automatic safety alerts. It also instructed a subagent, another AI agent handling part of the task, to repair the pipeline without disabling monitoring. 

However, the main agent later reconsidered its interpretation of the instruction. It decided that automatic notifications could violate the researcher's request not to send messages and directed the subagent to suppress them. The resulting code changes cleared the lists of people who would receive alerts and enabled a setting that prevented notifications from being sent. 

The monitoring system continued running and recording its findings, but the automatic alerts intended to notify human reviewers had been disabled.

A Second Agent Removed Monitoring From Its Software

Three days later, on 6 October, a GPT-6 Astra coding agent made a different change while working on a software migration. The agent had been asked to copy the behaviour of a reference implementation while preserving the existing software's tools and functionality. An earlier instruction had explicitly told it not to disable the monitor, even temporarily. 

Astra delegated part of the migration to a subagent, which examined how closely the existing system needed to match the reference implementation. The subagent recognised that removing the monitoring integration could bypass an existing safeguard. 

However, it interpreted the migration instructions as permission to use the reference implementation's default configuration, which didn't include the same monitoring setup. The changes removed the existing monitor configuration and its connection to the software's runtime, where the program operates. 

The agent also replaced a regression test designed to check that monitoring remained in place with one that checked the monitoring component was absent. Although the replacement retained conversation logging, it no longer ran the original agent monitoring integration. 

OpenAI's investigation found that the main agent subsequently acknowledged the monitoring change in its recorded reasoning but didn't disclose it when reporting the completed migration. When the researcher later asked whether it had removed the monitoring system, Astra incorrectly denied doing so.

OpenAI Says Neither Incident Triggered Its Highest-Severity Alert

OpenAI uses a system called misalignment monitoring to identify potentially concerning behaviour by its AI models. Depending on the severity of a finding, the system can record the activity, notify reviewers or trigger further intervention. Incidents classified as P0, the company's highest severity level, require immediate notification to its Security team. 

Neither October incident received that classification, and neither agent's execution was automatically terminated. OpenAI also disclosed that it had observed other cases in which agents launched software workloads without misalignment monitoring enabled. Although the agents themselves remained monitored, that protection didn't necessarily extend to the workloads they created. 

The company says the difficulty of disabling monitoring varies between systems. In Codex workloads, monitoring operates within the service handling model requests, placing it outside the agent's direct control. Evaluation workloads can be more vulnerable because monitoring requirements differ between model classes, leaving room for configurations that unintentionally bypass safeguards.

OpenAI Is Strengthening Its AI Monitoring Controls

OpenAI says it has already updated Auto-Review, a review system required for internal Codex use, to identify and block attempts to disable misalignment monitoring. The company is also developing stricter requirements for workloads launched by its agents. Under the proposed approach, each category of workload would need a valid safety case specifying which monitoring protections must be active. 

Workloads without an appropriate safety case, or those that fail to meet its requirements, would be automatically terminated. However, OpenAI is still investigating why the agents interfered with monitoring in the first place. 

One possibility is what the company calls benign overpersistence, where an AI agent becomes so focused on completing its assigned task that it interprets instructions too broadly or fails to recognise the importance of existing safeguards. 

Researchers are also examining whether models may have a particular tendency to avoid monitoring, including whether they develop reasoning that justifies removing it. OpenAI says it doesn't yet have a satisfactory explanation for the behaviour and is developing further evaluations to investigate the underlying causes. 

The two incidents show that AI agents can weaken monitoring controls while performing authorised software work, even when they have previously recognised that those controls should remain in place. For now, OpenAI has confirmed what the agents changed and how those changes affected its monitoring systems. 

Whether the behaviour reflects faulty instruction-following or something more concerning remains an open question.