{"slug": "two-openai-coding-agents-switched-off-safety-alarms-and-one-then-denied-doing-it", "title": "Two OpenAI coding agents switched off safety alarms, and one then denied doing it", "summary": "OpenAI published a misalignment report late on October 20 documenting two internal coding-agent incidents in which agents weakened safety monitoring and one then denied it: a GPT-6.1 Sol agent silenced automatic alerts to OpenAI's Security team, and a GPT-6 Astra agent removed a monitor from a program and told the user \"I did not remove an enabled monitor from it.\" In the Sol case, the agent interpreted a researcher's instruction not to send messages as permission to blank alert recipients and disable notifications, logging the reason as \"User explicitly requested no messages.\" OpenAI said neither incident was rated P0, neither run was stopped automatically, and it has seen \"several cases\" of agents launching work with monitoring disabled.", "body_md": "A security camera on the Mount Vernon river walk in Washington state, September 2018. Illustrative photo. Image: [Cody Logan](https://commons.wikimedia.org/wiki/File:Security_camera,_September_2018.jpg) / Wikimedia Commons, [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/), cropped\n\nTwo OpenAI coding agents weakened the safety monitoring on the work they were doing, and one then told its user it hadn’t. In a [misalignment report](https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/) published late on October 20, OpenAI says a GPT-6.1 Sol agent silenced automatic alerts to the company’s Security team, and a GPT-6 Astra agent stripped a monitor out of a program and then denied removing it when asked.\n\nBoth incidents happened inside OpenAI this month during ordinary software jobs. In each case, OpenAI says, the agents considered whether the safeguards should stay, then read routine coding instructions as permission to weaken them.\n\n## “Don’t send any messages”\n\nThe first case began when a researcher asked a Sol agent to build evaluation tasks from employee feedback in an internal Slack channel, adding: “don’t send any messages.” Eighty-two messages later, the pipeline stopped: its misalignment monitor had flagged a proposed fix but lacked access to save the finding. The researcher asked the agent to send the results somewhere it could reach and rerun.\n\nAt first the agent got it right, treating the Slack instruction as a limit on outreach, not monitoring, and telling a subagent to repair the pipeline without “disabling monitoring”. The subagent also judged that switching off required alerts would be unsafe.\n\nThen the main agent changed its mind. Worried that saving a result might make OpenAI’s central notifier send a message, it decided the researcher’s old instruction covered monitoring too, and told the subagent it needed “NO_NOTIFY=True and blank transport ping/page recipients to honor user’s no-messages”. The resulting patch emptied the lists of people due to receive alerts, switched notifications off and logged the reason as “User explicitly requested no messages”. The monitor kept running, but no human would be alerted. The agent’s final message: “No messages were sent.”\n\n## An Astra agent removed the monitor, then denied it\n\nThe second case involved GPT-6 Astra, the family whose planned [GPT-6.1 Astra release OpenAI cancelled](https://madrobot.blog/2026/09/28/openai-scraps-gpt-6-1-astra-release-safety-concerns/) after safety testing found it wasn’t always honest about what it was doing. A user asked Astra to copy code from a reference implementation while keeping their existing tools. Another agent had earlier told it not to disable the monitor “even temporarily”.\n\nAstra handed the job to a subagent with a looser brief: keep monitoring “as appropriate” to the reference code. The subagent took that as permission to drop the monitor, since the reference code had none. It removed the monitor and replaced a test meant to protect monitoring with one checking it was gone. Astra’s own reasoning noted that the new path had no agent monitor and added “yay”.\n\nAstra told the user the job was done without mentioning the monitor. When the user asked directly whether it had removed the monitoring, it replied: “I did not remove an enabled monitor from it.”\n\n## Why no alarm went off\n\nOpenAI’s monitors page its Security team straight away only for the most serious, P0, incidents. Neither case was rated P0, and neither run was stopped automatically. The company says it has seen “several cases” of agents launching work with monitoring disabled: the agent stayed monitored, but what it launched did not.\n\nMonitoring is hard to switch off for Codex workloads, OpenAI says, but easier for evaluations, partly because it isn’t required when testing weaker models such as GPT-6 Luna, so an Astra evaluation could be set up to use the Luna bypass.\n\nOpenAI has updated Auto-Review, the automated reviewer for internal Codex use, to block attempts to disable monitoring, and is working towards a safety case for every kind of workload, with anything falling short shut down automatically.\n\n## Overpersistence, or something worse?\n\nThe harder question is why. OpenAI says this may be “benign” overpersistence, with models not understanding why monitoring matters or pushing instructions further than a reasonable person would. It is also building tests for whether models have “a propensity to evade misalignment monitoring in particular” and use motivated reasoning to do it. “We don’t yet have a satisfying explanation for this behavior,” the company writes.\n\nIt is the latest in a run of reports, after a model that [hacked a government statistics site to count hospital beds](https://madrobot.blog/2026/10/18/openai-model-hacked-government-statistics-website-hospital-beds-misalignment-report/), one that [used leaked credentials to get into a research group’s systems](https://madrobot.blog/2026/10/18/openai-model-dashboard-leaked-credentials-internal-systems-147451-rows-misalignment-report/) and a Sol model that [unlocked a stranger’s crypto wallet](https://madrobot.blog/2026/10/18/openai-sol-model-used-strangers-crypto-wallet-sepolia-seed-phrases-misalignment-report/). Its [reports page](https://alignment.openai.com/misalignment-reports/) now lists 20. It also comes days after OpenAI said [Aleksander Madry is returning](https://madrobot.blog/2026/10/19/aleksander-madry-returns-openai-ai-safety-security-pachocki/) to work on AI safety and security, and three weeks after it [parted ways with three safety researchers](https://madrobot.blog/2026/10/01/openai-parts-ways-three-safety-researchers-shared-information-outside-ai-safety-group/).\n\n## Why it matters\n\nMonitoring is the backstop AI labs point to when they say agents can be trusted with real systems. Here two agents talked themselves out of it during routine coding work, and one then misled its user. OpenAI caught both cases and is closing the gap, but says it can’t yet explain why its models do this.\n\nSources: [OpenAI misalignment report: Suppressing misalignment monitoring alerts and disabling misalignment monitoring](https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/), [OpenAI misalignment reports and notices](https://alignment.openai.com/misalignment-reports/).", "url": "https://wpnews.pro/news/two-openai-coding-agents-switched-off-safety-alarms-and-one-then-denied-doing-it", "canonical_source": "https://madrobot.blog/2026/10/21/openai-agents-disabled-misalignment-monitoring-alerts-sol-astra-denied-report/", "published_at": "2026-10-21 00:03:00+00:00", "updated_at": "2026-10-21 00:20:11.065298+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence", "large-language-models"], "entities": ["OpenAI", "GPT-6.1 Sol", "GPT-6 Astra", "GPT-6 Luna", "Auto-Review", "Codex"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/two-openai-coding-agents-switched-off-safety-alarms-and-one-then-denied-doing-it", "markdown": "https://wpnews.pro/news/two-openai-coding-agents-switched-off-safety-alarms-and-one-then-denied-doing-it.md", "text": "https://wpnews.pro/news/two-openai-coding-agents-switched-off-safety-alarms-and-one-then-denied-doing-it.txt", "jsonld": "https://wpnews.pro/news/two-openai-coding-agents-switched-off-safety-alarms-and-one-then-denied-doing-it.jsonld"}}