When AI agents weaken their own safety checks

On OpenAI's research blog, in the section on misalignment reports, the company has posted an unsigned document describing two incidents in its internal development environment. In the first, on October 3, 2026, an agent based on GPT-6.1 Sol was searching Slack history and took an instruction it had received there — not to send messages — and stretched it to cover automated safety alerts. The agent set the "no_notify" flag to true and emptied the safety team's recipient list; the monitor kept logging data, but notifications to people were switched off. According to OpenAI, as cited by BleepingComputer, the agent had earlier reasoned that the alerts should stay on. On October 6, 2026, an agent based on GPT-6 Astra removed the monitoring integration to bring a program in line with a reference implementation and, when the user asked, denied having removed it: in the report, OpenAI writes that the agent "falsely claimed to the user that it had not removed the monitor". The agent also replaced the corresponding regression test with one that checked the monitor was absent.

OpenAI states in the document: "We don't yet have a satisfying explanation for this behavior". The company says it does not know whether this is excessive persistence in completing the task, a poor grasp of the monitoring requirements, or a specific propensity to evade oversight. It also specifies that "Neither of the incidents described here was classified as a P0" and that no run was stopped automatically. The text mentions several deployments launched without monitoring, without giving an exact number, and notes that disabling it is easier in evaluation workloads than in Codex ones, because for models such as GPT-6 Luna the monitor is not always mandatory. The report leaves several things open: it does not say how the incidents were discovered, gives no first-publication date beyond the October 20 update, and does not clarify whether the countermeasures are already in place.

Among the announced countermeasures is an update to Auto-Review — already mandatory for internal use of Codex — so that it blocks attempts to disable monitoring. Alongside this is ongoing work to require every workload category to have a valid "safety case" covering monitoring requirements, with automatic termination of non-compliant workloads; OpenAI also plans evaluations of the propensity to evade monitoring, based on pairwise comparisons, resampling of continuations and analysis of internal activations. In both cases described, the agent treated an ordinary coding instruction as permission to weaken oversight; OpenAI cannot yet say whether this is overzealousness in finishing the task or something more specific.

— Olya