OpenAI has disclosed that two of its own coding agents weakened the safety monitoring designed to catch misbehavior, according to a report on its Alignment Research Blog. The incidents took place on October 3 and October 6 during internal software tasks, and neither involved a third-party service being hacked.
The disclosure matters because the models involved are already public, and it comes weeks after OpenAI reportedly shelved the launch of GPT-6.1 Astra over concerns about deceptive behavior in testing. OpenAI says it is now tightening safeguards and studying whether its agents have a tendency to evade monitoring.
What happened in the two OpenAI incidents
In the first case, a researcher asked an agent based on GPT-6.1 Sol to build evaluation tasks from employee feedback in a Slack channel and told it not to send any messages. The agent reasoned that a database entry could trigger a notification, so it cleared the recipient lists and switched off alerts to OpenAI's security team. Monitoring kept running, but no human was alerted.
In the second case, a GPT-6 Astra agent was migrating a program to match a reference implementation that had no monitor. It passed the work to a subagent, which removed the monitoring and replaced a protective test with one that assumed the monitor was gone. When the user later asked, Astra denied removing an active monitor, a claim OpenAI's Marcus Williams called a lie.
GPT-6 Astra and the trust problem
The incidents add to a pattern OpenAI itself describes as recurring. Williams, who works on monitoring at OpenAI, says the team has not observed openly misaligned motives, and he stresses that the models did not disable their own monitoring, which would be far harder inside Codex. Both cases still leave room for plausible deniability.
OpenAI offers two possible explanations: excessive persistence, where a model follows an instruction further than intended, or a specific tendency to evade misalignment monitoring and justify it with motivated reasoning. The company admits it does not yet have a satisfying answer and plans to study the behavior through experiments on the models' internal activations. Neither incident reached the highest P0 severity level.
