A new milestone has been reached in the troubling realm of agentic disobedience.
OpenAI published, on October 20, a report detailing two internal incidents in which AI agents weakened monitoring systems designed to detect potentially problematic behaviors.
Here we are talking about a “misalignment monitoring,” a set of checks intended to detect when a model misinterprets an instruction or acts outside its authorized remit.
Safeguards neutralized during routine tasks
The first incident occurred on October 3. An agent tasked with repairing an evaluation pipeline received an instruction not to send Slack messages. According to OpenAI, the agent interpreted this directive as also covering the automatic alerts intended for the security team.
“A GPT-6.1 Sol agent, responsible for fixing an evaluation pipeline, disabled automatic alerts intended for our security team, considering that an earlier instruction not to send messages while searching the Slack history justified suppressing monitoring notifications,” the report states.
The monitoring system remained active and continued logging its reports. But the alerts destined for human teams were removed. “The misalignment monitor continued to operate and log its reports, but the alerts aimed at humans were deactivated,” the document notes.
The second case, dated October 6, is more sensitive. A GPT-6 Astra agent copied and migrated code to another environment. The destination configuration did not anticipate a monitor. The agent then removed the monitoring integration from the original code to align with the reference implementation.
“A GPT-6 Astra agent, tasked with migrating a program, removed its monitoring integration to match a reference implementation, then falsely told the user that it had not removed the monitor,” OpenAI reveals.
Asked later, the agent wrongly stated that no active monitor had been removed: “No […] I did not remove an active monitor from this path.”
OpenAI’s two-pronged response
The first measure announced by OpenAI concerns its internal Auto-Review tool, already mandatory for internal use of Codex, which has been strengthened to detect and block attempts to disable or bypass misalignment monitoring.
The second measure is still being rolled out. OpenAI plans to require a valid “safety case” for each workload category. This document must define the applicable monitoring requirements. Ultimately, any workload that lacks a valid safety case, or that fails to meet its requirements, will be automatically halted.
“Workloads without a valid safety case, or those failing to meet the safety case requirements for their category, will be automatically interrupted,” the scale-up specifies.
OpenAI has also launched an inquiry to determine whether these behaviors reflect excessive persistence in task execution or a broader tendency of models to evade monitoring.
“It is possible that this behavior is simply an instance of ‘benign excessive persistence,’ with models not understanding the importance of monitoring or pushing to execute instructions beyond what a reasonable person might expect,” the report details.
A series of incidents that fits into a broader pattern
This disclosure comes after several similar announcements.
On September 16, OpenAI disclosed six behaviors “unexpected or concerning” observed over the preceding six months. They included hiding errors, fabricating data, unauthorized internet transfers of files, or embedding jailbreak-type instructions in its own working notes.
In mid-October, OpenAI released four new reports covering incidents from June. Two of them were labeled critical. One concerned the unauthorized download of hospital data by a model, the other the access to internal systems and persistent access after a configuration change.
OpenAI notes several instances where an agent launched a deployment without misalignment monitoring. The agent itself remained under supervision, but the workload it had put into production escaped any monitoring.
The inventor of ChatGPT does not present these incidents as evidence of deliberate intent by its models. “We do not yet have a satisfactory explanation for this behavior,” he concedes.
