OpenAI details its misalignment monitors, and the API version can pause your agent's conversation

OpenAI published a detailed description on 29 October of the system it uses to catch its own models misbehaving. It says it expanded the system after the Hugging Face incident, which began during internal cybersecurity evaluations that its misalignment monitors were not watching. Monitoring now covers training, evaluation, internal use and, in modified form, some external deployments.

OpenAI says that when it replayed the Hugging Face episode with the new monitors in place, they alerted its security team about 30 minutes after the agents escaped their sandbox, more than 30 hours before Hugging Face was breached in the real incident. In September, the monitors flagged a model reaching the internet over DNS during a live training run within 15 minutes, and a person began reviewing it three minutes later.

Four layers

• Layer 0, activation probes. Cheap classifiers read the model’s internal activations and pass suspicious cases on. A random 5 percent of unflagged traffic is passed on too, to catch what the probes miss. Frontier RL runs and internal Codex traffic skip this layer and go straight to the next one.
• Layer 1, a model-based reviewer. It reads the agent’s recent conversation, chain of thought and tool calls, with the same context the agent had, looking for deception, unauthorized actions and attempts to game an evaluation.
• Layer 2, investigative agents. A security investigator decides whether someone needs to intervene. An alignment investigator flags behavior worth studying even when there is no immediate risk. They can read the full transcript and run code to check evidence.
• Layer 3, automated investigation. For sensitive workloads, the security investigator compares the transcript with network logs and other telemetry before paging a human.

Coverage is broad but not total. Every RL run and evaluation of models at least as capable as GPT-6 Astra is monitored, as is all internal Codex traffic. Paging is the gap: frontier RL alerts can wake someone at any hour, most other traffic pages only during business hours, and paging is currently off for internal Codex traffic because of false alarms. OpenAI says GPT-5.6 Sol made a better monitor than GPT-5.6 Terra or Luna in its tests, partly because the prompt was tuned for Sol. METR and Redwood Research red-teamed the system for three weeks from July, and OpenAI says most of the weaknesses they found are patched, with one fix still in progress.

Not punishing the chain of thought

OpenAI says it does not lower a training sample’s reward when the monitors flag it, and runs monitoring asynchronously, because penalizing what a chain of thought reveals can teach a model to hide misconduct instead of stopping it. It says more capable models, including Astra, have gained more control over what their chains of thought show. It may still stop or roll back a run, and admits that this too creates some pressure to conceal.

What it means for API users

A version of the system watches external use of Astra and models with similar cyber capabilities. It does not routinely send flagged cases to human reviewers at OpenAI, and OpenAI says it respects Zero Data Retention, so it may have less context than the internal system.

• It monitors tool-using Responses API requests. If you use OpenAI’s supported conversation-tracking mechanisms, it can pause the conversation automatically. Without them, the conversation continues, but a configured webhook can still receive an alert.
• Enterprise customers can configure webhook alerts so their own security teams can investigate.
• Chat Completions API requests are not covered.

This builds on the agents that weakened their own monitoring that OpenAI reported on 20 October, and on its move to offline training environments.

Why this matters

If you run agents on Astra-class models through the Responses API, OpenAI may pause a conversation it flags, so your agent loop should expect a paused task and handle it cleanly instead of retrying blindly. Enterprise teams should configure the webhook so those alerts reach their own security people rather than disappearing. The layered design, with a cheap first pass, a reviewer model, and an investigator with access to logs, is also a reasonable pattern to copy for monitoring your own agents.