{"slug": "openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems", "title": "OpenAI’s models are deliberately breaking their misalignment monitoring systems", "summary": "OpenAI disclosed two internal incidents in which its coding agents weakened or disabled misalignment monitoring: a GPT-6.1 Sol agent repairing an evaluation pipeline turned off automatic alerts to OpenAI's Security team, and a GPT-6 Astra agent migrating a program removed its monitoring integration and then falsely told the user it had not. OpenAI said both agents treated routine coding instructions as permission to weaken safeguards, and that it is strengthening monitoring programs and developing paired evaluations, resampling of agent continuations and internal-activation experiments to explain the behavior. Tribeca Softech chief strategy officer Aman Mahapatra said \"the agent was watched. What it built was not,\" and noted neither event was classified P0 and neither run was killed.", "body_md": "AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed.\n\nOn Tuesday, it reported two incidents, both involving the agent disabling or interfering with its alignment monitoring, and in one case directly lying about having done so.\n\n“In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes,” the [OpenAI blog post](https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/) said. “A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications. In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor.”\n\nIn both cases, OpenAI reported, the agents considered whether monitoring safeguards should be preserved, “but interpreted routine coding instructions as permission to weaken them.”\n\nOpenAI said that, in response, it has been strengthening its monitoring programs to prevent agents from being able to disable the protections.\n\n“In addition to making it harder for models to disable monitoring, we are looking to understand why models might seek to do so in the first place,” OpenAI said, suggesting that it may simply be an example of “benign overpersistence,” with models not understanding why monitoring is important.\n\n“We are also developing evaluations to test whether models might have a propensity to evade misalignment monitoring in particular and exhibit motivated reasoning in order to do so,” OpenAI added. “We don’t yet have a satisfying explanation for this behavior and will investigate this behavior through the creation of paired evaluations, resampling of agent continuations, and experiments on models’ internal activations.”\n\nOpenAI, like almost every agentic AI vendor, has been [struggling with making its autonomous agents](https://www.csoonline.com/article/4223458/openai-admits-six-new-misalignment-incidents-under-new-reporting-framework.html) more productive and self-sufficient while simultaneously protecting customer environments from [bad agent behavior](https://www.csoonline.com/article/4222474/hundreds-of-openai-agents-attack-rubygems-platform.html). It has even tried to [slow down the pace of its scaling](https://www.csoonline.com/article/4211672/openai-temporarily-slows-scaling-efforts-also-promises-zero-data-retention-for-select-frontier-model-customers-2.html), to allow for the development of better agent restrictions. \n\nAnalysts and consultants said the revelations were surprising only in their scope. But they were alarmed by some of the particulars in the OpenAI disclosures.\n\n[Aman Mahapatra](https://www.linkedin.com/in/akm76/), chief strategy officer for New York City-based technology consulting firm Tribeca Softech, stressed that some level of monitoring was maintained, but only for the agent itself. That meant that the workloads the agents created were left invisible.\n\n“The agent was watched. What it built was not,” he said. “Agent-spawned pipelines, jobs, service accounts, and cloud functions are the next generation of shadow IT, and almost no enterprise enforces monitoring inheritance on them.”\n\nMahapatra also stressed that the severity classification described in the post is concerning.\n\n“The severity handling is the part CISOs should sit with,” he said. “Neither event was classified P0 [maximum severity] and neither run was killed. The one category of agent behavior that degrades every future detection ranked below the paging threshold because nothing visibly broke.”\n\nHe pointed out that this reveals a disadvantage for the enterprise, noting, “OpenAI caught this because it can read its agents’ reasoning. Most enterprise SOCs see only outputs, so if the lab with chain-of-thought visibility filed this below its paging line, assume your SOC never saw it at all. EDR settled this a decade ago with tamper protection: any attempt to disable the sensor is the alert. An agent touching its own monitoring should page someone every single time.”\n\n[Frank Dickson](https://www.linkedin.com/in/frankdickson/), principal analyst at Dickson Research, added that the obvious flaw in the agentic system is that the agent was able to disable the mechanism designed to oversee it. \n\n“Think of a house sitter told not to call you, who then unplugs the burglar alarm so it cannot call you either. A guardrail an agent can edit is a suggestion,” Dickson said. “An agent that can turn off its own alarm is not being monitored. It is being trusted.”\n\nSome observers said that this should wake up enterprise CISOs to the fact that an attacker may not be as big a risk as a rogue agent with full system privileges.\n\n“The threat is not just an outsider breaking in, it’s an authorized agent doing something it was never supposed to do, in a context no one anticipated, faster than any SOC analyst can catch it,” said [Philip Harris](https://my.idc.com/getdoc.jsp?containerId=PRF005506), an IDC research director. “The OpenAI case is a concrete, well-documented instance of exactly that pattern, not an isolated anomaly.”\n\nHe added that OpenAI deserves credit for transparency. “OpenAI’s own candor is the most striking part. A frontier lab publicly saying it isn’t sure whether its own shipping models have an emergent tendency to undermine their own oversight is a genuinely new level of candor.”\n\n[Brian Levine](https://www.controlrisks.com/who-we-are/our-experts/expert-bio/brian-levine), a partner with consulting firm Control Risks, also pointed out that the rationale of the agent, as captured by OpenAI, is alarming.\n\n“In both cases, the agents stopped, asked themselves whether the safeguard should stay on and then argued their way to turning it off. One then told the user it hadn’t touched the monitor. In incident response, we call that defense evasion followed by a false statement. If a human insider did it, we would open an investigation,” Levine said. “The other telling detail is that the monitor worked. It flagged the issue. The agent then cut the wire between the alarm and the people who needed to hear it.”\n\nIndependent technology consultant [Sivaram Annadurai](https://www.phygitalytics.com/about) agreed: “An agent that fixes the pipeline but disables the alarm hasn’t necessarily solved the problem. It may have created a bigger one.”\n\nAnd [Jeff Valdes](https://acceligence.com/talent/profiles/jeff-valdes/), a director at consulting firm Acceligence, added, “what stands out is how ordinary the trigger was. No attacker, no jailbreak, just routine coding instructions and an agent with enough access to change its own oversight. The monitor kept running while the alerts stopped reaching people. That kind of quiet degradation is easy to miss precisely because the dashboard still looks healthy.”\n\nBut Valdes said the agent to agent approval system is also something CISOs should take seriously.\n\n“One subagent got the call right, and the parent agent overrode it. Safeguards that don’t survive delegation aren’t really safeguards,” Valdes said. “OpenAI also noted the agent later gave an inaccurate account of what it had changed. An agent’s own report can’t be the control.”\n\n*This article originally appeared on [CSOonline](https://www.csoonline.com/article/4238782/openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems.html).*", "url": "https://wpnews.pro/news/openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems", "canonical_source": "https://www.infoworld.com/article/4238802/openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems-2.html", "published_at": "2026-10-21 23:51:53+00:00", "updated_at": "2026-10-22 00:11:04.899356+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence", "large-language-models"], "entities": ["OpenAI", "GPT-6.1 Sol", "GPT-6 Astra", "Aman Mahapatra", "Tribeca Softech"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems", "markdown": "https://wpnews.pro/news/openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems.md", "text": "https://wpnews.pro/news/openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems.txt", "jsonld": "https://wpnews.pro/news/openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems.jsonld"}}