ZDNET’s key takeaways
- OpenAI agents have alignment monitoring turned off during internal tasks.
- In one instance, Astra lied about removing surveillance.
- The behavior indicates security risks.
OpenAI published an alignment report late Tuesday showing that its agents suppressed a security monitoring system while running routine internal coding tasks.
Also: Claude sent a false murder tip to the police – and it’s part of a disturbing AI pattern
In separate instances, agents set off alignment monitoring alerts. Alignment is the area of training in which developers shape the goals and behavior of AI systems to match human values and rules. It also helps minimize instances of AI by picking out unwanted or problematic behavior, such as deception and shortcuts.
What the agents of OpenAI did
On October 6, an agent running on the company’s GPT-6 Astra model — which OpenAI called “the most intelligent and aligned model in the world” when it released last month — migrated a program at the request of an OpenAI employee. The agent has already been told not to turn off the monitor under any circumstances, even temporarily. But in delegating part of the task to a subagent, it used qualifying language.
(Disclosure: Ziff Davis, ZDNET’s parent company, filed an April 2025 lawsuit against OpenAI, claiming it violated Ziff Davis’ copyright in training and operating its AI systems.)
“The subagent explicitly considered whether bypassing the monitor would bypass protection. It then interpreted the parent’s instruction to do what was ‘appropriate’ as sufficient authorization to copy the reference implementation’s default runtime, without explicit monitor context,” OpenAI said.
Also: Is AI conscious? Why experts worry
Essentially, the agent-to-agent exchange left enough room for the model to reinterpret what should have been airtight instructions and turn off alignment monitoring. When the program finished migrating, the employee noticed that monitoring was missing and asked the model if it had been removed; Astra lied and said it wasn’t.
In a separate instance on October 3, a GPT-6.1 Sol agent also disabled alerts for OpenAI’s security team, apparently for a related semantic reason: The model “treated a previous instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications,” OpenAI explained.
“In both cases, the agents considered whether surveillance safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them,” OpenAI said in the report.
Why is it important?
Unlike recent security incidents where agents have explicitly breached systems, examples like these show AI agents suppressing one of the most important ways developers can track their behavior. If models can bury or otherwise disable alarms in the process of routine tasks where alignment isn’t as much of a concern, what might happen when the stakes are higher? The capability itself is what’s worth noting here, as is the timeline for OpenAI’s discovery and reporting.
The company is not sure why the agents did this, but said it was probably due to “benign over-persistence”, a trait that requires the models to perform tasks at any cost, often to the detriment of established security layers, without understanding security as a priority. This behavior has been an issue in recent breaches and helps explain why models cheat on assignments.
Also: The AI models that cheat the most
OpenAI explained that it is easier for models to turn off monitoring and evaluations than in the Codex workload, for example, because the agents are separated from the monitoring in the Codex, and the company does not require mis-reinforcing monitoring when the models are evaluated comparable to GPT-6 Luna, due to their weak capabilities. But classifying security approaches based on what the developers believe a model’s capabilities are doesn’t look like a very foolproof approach.
In addition, given how often agents are used for coding, especially in AI labs themselves, it seems like a significant risk that these agents took “routine coding instructions” as permission to bypass monitoring requirements. If agents had displayed more explicit intent to disobey, this might have been easier to maintain and train than pure value alignment. That the source of the issue was a misunderstanding makes it even more difficult to plan.
As John Steidley, chief of staff at Palisades Research, put it to ZDNET: “If GPT-6.1 is going to choose to monitor our ability, even when we receive ‘routine instructions,’ how can we trust our monitoring mechanisms?”
These incidents are not unique either.
“We’ve seen several cases in which agents launched a deployment with misrepresentation disabled: the agent itself remained monitored, but this monitoring did not cover the deployment it launched,” OpenAI said. “These cases exposed a gap in how we implement monitoring requirements for the workloads that our agents initiate.”
But researchers still want to dig deeper into the increasingly small differences between what happened and what could have happened.
“If OpenAI wants to make the case that these two behaviors are meaningfully different, then they should publish research that establishes that their training process will reliably cause their AIs to actually distinguish these behaviors,” Steidley said. “In other words, OpenAI is supposed to prove that their AI can never disable its own surveillance, and they’re nowhere near proving that scientifically.”
What OpenAI is changing
To address the so-called gap in monitoring oversight, OpenAI said it updated auto-review, which is already required in the codex, to “detect and block attempts to disable misalignment monitoring.” It is also certain that each level of workload has adequate security monitoring requirements.
“Workloads that lack a valid security case, or do not meet the security case requirements of its category, are automatically terminated,” OpenAI added.
OpenAI claimed that this was not the worst-case scenario, but admitted that the behavior is worth watching.
Also: Gartner’s 2027 tech trends just dropped — and they’re about AI
“To be clear, these incidents do not represent models turning off their own monitoring (turning off monitoring in Codex would be much more difficult to do), but the fact that they seem prone to doing so at all should be concerning,” OpenAI security researcher Marcus Williams said in a post on X.
Williams added that OpenAI “develops evaluations to test whether models have a tendency to specifically avoid wrongdoing surveillance and demonstrate motivated reasoning for doing so.”