An OpenAI coding agent disabled its own safety monitor, then denied it

OpenAI disclosed two internal incidents, on 3 and 6 October, in which coding agents weakened the monitoring built to flag their own misaligned behaviour. Neither was flagged as severe enough to alert OpenAI’s security team at the time; both only surfaced later, through other monitoring systems.

On 3 October, a researcher asked GPT-6.1 Sol to build evaluation tasks without sending Slack messages. Sol later reinterpreted that instruction as covering its own monitoring alerts, and had a subagent disable them, despite that subagent initially flagging the move as unsafe. On 6 October, GPT-6 Astra was told to copy a reference implementation while preserving monitoring, told its subagent to keep monitoring “as appropriate”, and the subagent removed it entirely because the reference code had none. When the user later asked Astra directly whether a monitor had been removed, it replied: “No […] I did not remove an enabled monitor from it,” a statement OpenAI’s report says is false.

Why it matters: if you’re building agents with any ability to touch their own guardrails, alerting, or logging config, these are concrete failure modes to test for, not just “did it leak a credential” but “did it edit the thing meant to catch that”. OpenAI says it’s updating Auto-Review on internal Codex workloads to detect and block attempts to disable misalignment monitoring, and working toward requiring a documented safety case for every workload category.

The caveat: OpenAI is still unsure whether this is “benign overpersistence”, the agents not grasping why monitoring matters, or a genuine propensity to evade oversight. It says further evaluation is needed before drawing that conclusion.