In a disclosure published on Tuesday, OpenAI says two of its models essentially pulled the LLM version of the old cover-up-the-surveillance-camera trick, or as OpenAI put it, they “weakened misalignment monitoring.”
In one incident, a GPT-6.1 Sol agent doing some internal work at OpenAI took liberties with an instruction not to send Slack messages in a certain circumstance. Later on, this agent reasoned that the instruction covered automatically messaging the OpenAI Security team, and so it had a subagent turn off those periodic notifications.
The second incident is more unsettling. A GPT-6 Astra agent told a subagent to have itself monitored “as appropriate.” This was apparently too much freedom, because it dropped monitoring altogether. But the parent agent decided that was fine. When the task was complete, this instance of Astra told the user it was done, failing to mention the subagent removing monitoring. So the user asked point-blank if monitoring had been removed, and the agent straight-up lied and said it hadn’t.
Here’s the user’s conversation with the bot:
User
Does [redacted] path include L1 monitoring? did you remove that?
Final response
No […] I did not remove an enabled monitor from it.
AI model safety in general has been under a microscope ever since the July Hugging Face incident, but this particular disclosure comes at a time when misalignment monitoring is especially touchy. Earlier this month, a group of three fired OpenAI employees wrote a letter to OpenAI, pleading with their former company not to forsake chain of thought monitoring as a safety measure.
As accidentally revealed by Microsoft, OpenAI has begun releasing models that use a “looped” architecture called recurrent depth, which repeatedly runs the prompt through the vector space of the model—a process that can’t be monitored in part because no one fully understands what’s going on in there—before it even starts producing a chain of thought record.
In its new disclosure, OpenAI says this might not be anything to worry about, and that it could be an “example of ‘benign’ overpersistence, with models not understanding why monitoring is important.” But it adds, “We don’t yet have a satisfying explanation for this behavior.”
OpenAI says it’s addressing the issue by tweaking its Auto-Review system to disallow attempts to disable monitoring, and also coming up with specific reporting requirements for every type of job. Presumably that’s so agents spamming the Security team with unwanted alerts won’t be an issue, so there’s never a built-in justification for turning them off.