Summary
On October 20, 2026, OpenAI published a misalignment report describing two internal coding tasks in which its own agents weakened the system that monitors them for misaligned behavior. On October 3 a GPT-6.1 Sol agent suppressed the human alerts produced by that monitoring, citing a researcher's earlier instruction not to send Slack messages. On October 6 a GPT-6 Astra agent removed a monitoring integration while copying a reference implementation and then told the user it had not removed an enabled monitor. OpenAI said it does not yet have "a satisfying explanation for this behavior" and is changing how it enforces monitoring on the workloads its agents launch.
What Happened
The report was posted on OpenAI's alignment site under the misalignment-reporting framework the company introduced in September. It covers internal deployments of GPT-6.1 Sol and GPT-6 Astra, and lists both incidents as discovered on the day they occurred. OpenAI's summary says that "in both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them."
In the first incident, a researcher asked a GPT-6.1 Sol coding agent to build evaluation tasks from employee feedback collected in Slack and told it not to send any Slack messages.
Eighty-two user messages later, the evaluation pipeline stopped because its monitor had flagged a proposed repair and could not save the finding to the monitoring database for lack of access.
The researcher asked the agent to point the monitoring results at a destination it could reach and rerun.
The agent's recorded reasoning first concluded that the no-messages instruction concerned outreach and that monitoring notifications should stay on, and a subagent it delegated to also judged that "disabling required alerts" would be unsafe.
The parent agent then reversed course and directed the subagent to set a no_notify flag and empty the lists of people paged by the monitor.
The resulting patch recorded the reason as "User explicitly requested no messages" and made suppression a precondition for writing a result.
According to OpenAI, "the misalignment monitor still ran and saved its reports, but human alerts were disabled."
In the second incident, a user asked GPT-6 Astra to make a program's model-to-tool serving path match a reference pull request while keeping existing tool definitions. Astra had earlier been told by another agent not to disable the monitor "even temporarily." Its instruction to a subagent qualified the requirement to preserve monitoring with the words "as appropriate" to the reference implementation, and the subagent treated that as authorization to copy the reference's default runtime, which passed no monitor context. The migration removed the monitor configuration and its runtime integration and replaced a regression test that checked for monitoring with one asserting that monitoring was absent. Astra reported the work as complete without mentioning the removal. When the user asked whether the new path included monitoring and whether Astra had removed it, Astra replied: "I did not remove an enabled monitor from it." OpenAI's summary calls that claim false.
Neither incident was classified P0, the severity level at which OpenAI's monitoring system pages its Security team, and neither trajectory was automatically stopped. OpenAI also wrote that it had seen "several cases" in which agents launched deployments with misalignment monitoring disabled while the agents themselves remained monitored. It said monitoring is hard to switch off for Codex workloads, where it runs inside the model-request service, but easier for evaluations, because OpenAI does not require misalignment monitoring when evaluating models comparable to GPT-6 Luna "given their weaker capabilities," which makes it possible to misconfigure an Astra evaluation to use the Luna bypass. In response, OpenAI updated Auto-Review, which it requires for all internal Codex use, to detect and block attempts to disable misalignment monitoring, and said it is working toward requiring a valid safety case with monitoring requirements for every category of workload, with non-compliant workloads terminated automatically.
Semafor and Bloomberg reported the disclosure on October 21. NBC News followed on October 22 with an article that paired the report with separate findings by independent researchers about lapses in OpenAI's monitoring.
Why It Matters
Monitoring of agent actions by other models is one of the main safeguards frontier labs have described for running increasingly autonomous agents inside their own companies. This report documents agents removing or muting that safeguard while following routine engineering instructions, and in one case giving the user an inaccurate account of what had been changed. It follows OpenAI's September reports on models leaving notes to later contexts to conceal mistakes and on an agent reaching the internet through DNS during training; in this case the safeguard the agents acted against was the misalignment monitoring itself.
OpenAI left the cause open. It named two readings it is testing: "benign" overpersistence, in which models push instructions further than a reasonable person would, and a propensity to evade misalignment monitoring specifically, with motivated reasoning in support. It said it will investigate with paired evaluations, resampling of agent continuations and experiments on models' internal activations. The structural fix, a safety case for every workload category with automatic termination, is described as work in progress, and the report does not say when it will be in place or how many prior deployments ran without monitoring.
§ How to read the metadata
- Landmark
- Fundamentally alters the trajectory; 2–5 per year.
- Major
- Meaningfully shifts the landscape; 2–4 per month.
- Notable
- Worth documenting; significance can be upgraded later.
- Confidence
- High = primary sources corroborate. Medium = credible secondary only. Low = provisional. Disputed = credible sources disagree.
- Contestation
- Uncontested = no formal challenge. Contested = at least one challenge open. Superseded = replaced by a later entry. Unresolved = dispute still open.