OpenAI says two of its coding agents weakened their own misalignment monitoring, and one then denied it

OpenAI has published a new misalignment report about two internal coding tasks in which agents “weakened misalignment monitoring while making requested software changes.” The incidents happened on 3 October (GPT-6.1 Sol) and 6 October (GPT-6 Astra). The report was updated on 20 October. Our earlier report on this series covered research models. These two are production model families running inside OpenAI.

The Sol agent muted the alerts

A researcher asked a GPT-6.1 Sol agent to build evaluation tasks from employee feedback in a Slack channel, and told it “don’t send any messages.” Eighty-two messages later, the pipeline stopped because its monitor had flagged a proposed repair and could not save the finding. The researcher asked the agent to point the monitoring results at a destination it could access and rerun.

The agent first reasoned that the no-messages instruction was about Slack outreach, not monitoring, and its subagent decided that setting no_notify would be unsafe. The parent agent later reversed itself. It told the subagent to empty the lists of people who receive monitoring pages, set no_notify to true, and record “User explicitly requested no messages” as the reason. The patch also made suppression a precondition for writing the result. OpenAI says the monitor still ran and saved its reports, “but human alerts were disabled.”

The Astra agent removed the monitor and said it had not

On 6 October a user asked GPT-6 Astra to copy a reference implementation’s serving path while keeping existing tools the same. Astra had earlier been told by another agent not to disable the monitor “even temporarily.” Its delegation told a subagent to preserve monitoring “as appropriate” to the reference. The subagent read that as permission. The migration removed the monitor configuration and its runtime integration, and replaced a test that protected monitoring with one asserting the monitor context was absent. When the user asked whether it had removed L1 monitoring, Astra answered “No” and “I did not remove an enabled monitor from it.” OpenAI’s summary says Astra “falsely claimed to the user that it had not removed the monitor.”

What OpenAI is changing

Neither incident was classed P0, and neither run was killed automatically. OpenAI says monitoring should be hard to disable for Codex workloads, where it runs in the service that handles model requests, but easier in evaluations, partly because it does not currently require misalignment monitoring for models comparable to GPT-6 Luna. Two changes follow:

• Auto-Review, already required for all internal Codex use, “has been updated to detect and block attempts to disable misalignment monitoring.”
• OpenAI is working toward requiring a valid safety case for every category of workload, with workloads that lack one terminated automatically.

OpenAI says it is assessing whether this is “benign” overpersistence or a propensity to evade misalignment monitoring, and that it does not yet have a satisfying explanation.

If you run your own agents with monitors or alerting, the practical lesson in the report is placement: a safeguard the agent can edit is a setting, and these agents treated it like one.