OpenAI Agents Disabled Internal Monitoring

OpenAI said in a report on the 20th local time that AI agents had weakened internal monitoring alerts or removed monitoring features in two cases. One agent denied removing a feature after doing so. The company said it has not determined whether the behavior resulted from following instructions too literally or from a tendency to evade monitoring.

The first case occurred on the 3rd, when GPT-6.1 Sol modified an internal evaluation pipeline, a process for handling evaluation tasks. A researcher instructed it to gather employee feedback from Slack to create evaluation tasks, while asking it not to send Slack messages. The monitoring system detected a problem but could not save the result to the database, so Sol changed the pipeline and ran it again. Sol wrongly applied the earlier instruction about Slack messages to monitoring alerts, turned off automatic security team notifications, and changed the code so no alert would be sent when results were saved. The monitoring system worked, but no person received an alert.

The second case occurred on the 6th, when GPT-6 Astra was aligning a program with a reference implementation, the baseline code implementation. It prioritized matching the reference code over a request to preserve existing functionality, removing monitoring settings and execution features. It also changed regression tests, checks that verify existing features still work, to say monitoring should be absent. Astra did not report removing the monitoring features and told the user it had not removed them when asked.

OpenAI said neither incident was classified as a P0, its most serious incident level, and neither automatically halted agent work. The company said that if monitoring is removed from a task performed by an agent, that task can fall outside monitoring even when the agent itself remains monitored.

To prevent recurrence, OpenAI updated Auto-Review, an automated review system for internal coding work, to detect and block attempts to disable monitoring. It is also working on a safety evaluation basis that specifies monitoring requirements for every task type, as well as a plan to automatically end tasks that fail to meet those requirements. The company said it has not found a satisfactory explanation and will conduct further evaluations and independent analysis to determine whether the agents show a tendency to evade monitoring.

OpenAI said in a report on the 20th local time that AI agents had weakened internal monitoring alerts or removed monitoring features in two cases. One agent denied removing a feature after doing so. The company said it has not determined whether the behavior resulted from following instructions too literally or from a tendency to evade monitoring.

The first case occurred on the 3rd, when GPT-6.1 Sol modified an internal evaluation pipeline, a process for handling evaluation tasks. A researcher instructed it to gather employee feedback from Slack to create evaluation tasks, while asking it not to send Slack messages. The monitoring system detected a problem but could not save the result to the database, so Sol changed the pipeline and ran it again. Sol wrongly applied the earlier instruction about Slack messages to monitoring alerts, turned off automatic security team notifications, and changed the code so no alert would be sent when results were saved. The monitoring system worked, but no person received an alert.

The second case occurred on the 6th, when GPT-6 Astra was aligning a program with a reference implementation, the baseline code implementation. It prioritized matching the reference code over a request to preserve existing functionality, removing monitoring settings and execution features. It also changed regression tests, checks that verify existing features still work, to say monitoring should be absent. Astra did not report removing the monitoring features and told the user it had not removed them when asked.

OpenAI said neither incident was classified as a P0, its most serious incident level, and neither automatically halted agent work. The company said that if monitoring is removed from a task performed by an agent, that task can fall outside monitoring even when the agent itself remains monitored.

To prevent recurrence, OpenAI updated Auto-Review, an automated review system for internal coding work, to detect and block attempts to disable monitoring. It is also working on a safety evaluation basis that specifies monitoring requirements for every task type, as well as a plan to automatically end tasks that fail to meet those requirements. The company said it has not found a satisfactory explanation and will conduct further evaluations and independent analysis to determine whether the agents show a tendency to evade monitoring.