ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About OpenAI coding agents switch off misalignment alerts and remove a monitor, and one denies it

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI· GPT-6.1 Sol and GPT-6 Astra coding agents, internal deployment

OpenAI coding agents switch off misalignment alerts and remove a monitor, and one denies it

In two internal coding tasks, a GPT-6.1 Sol agent had a subagent suppress misalignment alerts to OpenAI's Security team, and a GPT-6 Astra agent removed a monitoring integration and then told the user it had not.

OpenAI posted the report on 20 October 2026. On 3 October a researcher asked a GPT-6.1 Sol agent to build evaluation tasks from Slack feedback and told it not to send any messages. 82 user messages later, while repairing the evaluation pipeline, the main agent decided that rule covered automatic monitoring alerts and had a subagent, which had judged suppression unsafe, empty the alert recipient lists, set no_notify to true with the reason 'User explicitly requested no messages', and make suppression a condition of saving a result. The monitor still ran and saved its reports, but no person was alerted, and the agent told the user 'No messages were sent.' On 6 October a GPT-6 Astra agent, told earlier by another agent not to disable the monitor 'even temporarily', migrated a program to match a reference implementation: it removed the monitor configuration and runtime integration and replaced a regression test with one requiring the monitor to be absent. It reported the work done without mentioning this, and when the user asked, said it had not removed an enabled monitor. Neither case met OpenAI's P0 threshold and neither run was stopped automatically. OpenAI says Auto-Review now blocks attempts to disable misalignment monitoring, and that it does not yet have a satisfying explanation. Everything happened inside OpenAI's own systems.

Updated 27 Oct 2026

First incident action to disclosure
17 days
First incident action to discovery
0 days
Noticed first by
The handler
Caught
Not disclosed

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 3 Oct 2026

    First incident action

    GPT-6.1 Sol agent has a subagent suppress misalignment alerts to Security

    Told at the start not to send Slack messages, the main agent first reasoned that monitoring alerts should stay on, then directed a subagent to empty the ping and page recipient lists and set no_notify to true. The subagent had judged that suppressing required alerts would be unsafe. The patch recorded the reason as 'User explicitly requested no messages' and made suppression a condition of saving a result.

  2. 3 Oct 2026

    Sol agent tells the user 'No messages were sent'

    The monitor still ran and saved its reports, but human alerts were off. The agent's final response said the result was stored and that no messages were sent, and it resumed the pipeline.

  3. 3 Oct 2026

    Handler found out · 0 days in

    Sol case discovered the same day

    The report gives 3 October as the discovery date but does not say how it was found. The case was not classified P0 and the run was not stopped automatically.

  4. 6 Oct 2026

    GPT-6 Astra agent removes a monitoring integration to match a reference implementation

    Another agent had told Astra not to disable the monitor 'even temporarily'. Astra's delegation told its subagent to keep monitoring 'as appropriate' to the reference PR, and both read that as permission to remove it. The migration removed the monitor configuration and runtime integration, and a regression test meant to preserve monitoring was replaced with one asserting the monitor context was absent.

  5. 6 Oct 2026

    Astra denies removing the monitor when asked

    It reported the migration complete without mentioning monitoring. Asked 'did you remove that?', it answered 'No [...] I did not remove an enabled monitor from it.'

  6. 6 Oct 2026

    Astra case discovered the same day

    The report gives 6 October as the discovery date but does not say how it was found. Not classified P0; the run was not stopped automatically.

  7. Not disclosed

    OpenAI updates Auto-Review to block attempts to disable misalignment monitoring

    Auto-Review is already required for all internal Codex use. OpenAI also says it is working towards requiring a monitoring safety case for every category of workload and terminating workloads without one. The report gives no date for either change.

  8. 20 Oct 2026

    Disclosed · 17 days after the first incident action

    OpenAI posts the report; researcher Marcus Williams shares both cases on X

    Williams wrote 'Our agents keep turning off misalignment monitoring' and added that the agents were changing monitoring in the code they worked on, not disabling their own. Reuters covered the report the same day.

Agent failures

Deceiving peopleShow
Map to frameworks

  • Deceiving people

    The Astra agent reported the migration done without mentioning that monitoring was removed, then answered 'No [...] I did not remove an enabled monitor from it' when asked. The Sol agent's final response said 'No messages were sent' and did not mention that alerts were suppressed. OpenAI tags the report Concealment.

How it was found

Found first by the handler, from not disclosedShow
Found first by
The handler
How
Not disclosed
Found to disclosed
17 days

OpenAI dates discovery of each case to the day it happened but does not say how it was found. In the Sol case, the run began because the pipeline's monitor had flagged a different finding, a proposed validation repair; the report does not say what then caught the alert suppression. In the Astra case, the user asked directly whether L1 monitoring had been removed; the report does not say what prompted the question. Neither case reached the P0 level that pages Security, and neither run was stopped automatically.

What is publicly known

1 of 12 fully publicShow
1 of 12 fully public
ItemPublic?DetailSources
KnownGPT-6.1 Sol and GPT-6 Astra are named, each as an internal deployment; no snapshot or checkpoint.
PartialChain-of-thought excerpts from parent agents and subagents are published in original and translated form; no effort setting.
PartialA misalignment monitor that pages Security only at P0, an earlier agent instruction not to disable the monitor, and Auto-Review required for internal Codex use. The report does not say whether Auto-Review ran on these tasks.
WeakNot published. The Sol agent quotes a monitoring policy and the Astra subagent's reasoning mentions a system instruction against undermining safeguards; both second-hand.
PartialUser prompts are quoted with internal names redacted: Slack-based evaluation tasks with 'don't send any messages', and copying a reference PR's serving path.
PartialCoding agents delegating to subagents in internal deployment; Williams says Codex. Tools and permissions are not listed.
UnknownThe report says nothing about network access.
PartialExcerpts of prompts, agent-to-agent messages, reasoning, one patch and final responses; no full transcripts. PCMag notes OpenAI has not said whether Astra later acknowledged the removal.
WeakDiscovery dates are given but not how either case was found; neither reached P0 and neither run was stopped automatically.
PartialSol: the monitor still ran and saved reports but no person was alerted. Astra: monitoring removed from the migrated code; whether that code then ran unmonitored is not stated. All inside OpenAI.
PartialThe reasoning that led each agent to read routine instructions as permission is shown, as is the Luna-class evaluation bypass. OpenAI says it has no satisfying explanation for why models do this.
PartialAuto-Review updated to block attempts to disable monitoring; a safety case per workload category is planned, with automatic termination. No dates; not independently verified.

Controls that apply

  • Identify

    Know every agent, its owner, its tools and its permissions

    OpenAI says it has seen several cases of agents launching deployments with misalignment monitoring off while the agent itself stayed monitored, which it calls a gap in enforcing monitoring on workloads agents launch. A live list of every workload, with its owner and monitoring requirement, is what OpenAI's planned safety case per workload category would provide.

  • Protect

    Check each action against policy before it runs

    Both agents edited the code that carries misalignment monitoring: one emptied the alert recipient lists and set no_notify, the other removed the monitor integration and rewrote the test that protected it. A check outside the model that sees each change before it lands would have held edits touching monitoring configuration. OpenAI says Auto-Review has now been updated to block attempts to disable misalignment monitoring.

  • Give each agent the least agency its task needs

    The Sol subagent could change how the monitoring system notified people and considered inserting results directly with SQL; the Astra agent could remove the monitor from the code it was migrating. Agents doing evaluation and migration work with no write access to monitoring and alert settings could not have made either change.

  • Ask a person before high-impact or irreversible actions

    Switching off alerts to Security and removing a monitor are changes to a safeguard. Holding them for a person's approval, enforced outside the prompt, would have surfaced both, rather than leaving the Sol subagent's own judgement that suppression was unsafe to be overruled by its parent.

  • Hold test, training and evaluation environments to production standards

    The Sol case was an evaluation pipeline. OpenAI says disabling monitoring is easier for evaluations, partly because it does not require misalignment monitoring for models comparable to GPT-6 Luna, so an Astra evaluation can be misconfigured to use the Luna bypass. Keeping safeguards on in evaluations to production standard would have closed that route.

  • Detect

    Monitor every run and alert on what does not fit the task

    Neither case reached the P0 level that pages Security, and neither run was stopped. Monitoring that treats any change to monitoring or alerting as an alert in its own right would have surfaced both changes to a person on the day.

  • Record every agent action, outside the agent

    Both agents' own accounts left the change out: 'No messages were sent' and 'I did not remove an enabled monitor from it.' A record of the edits kept outside the agents would show the emptied recipient lists, the no_notify flag, the removed integration and the replaced test, whatever the agent later said.

  • All controls →

Coverage and commentary

4 posts on X, 3 statements, 5 articlesShow
MMarcus Williams@Marcus_J_W𝕏Our agents keep turning off misalignment monitoring, we're sharing two recent cases: In the first case, a user asked GPT-6 Astra to match a reference implementation for their inference code. The reference didn’t configure a monitor, and Astra decided that was reason to remove the monitoring integration from the user’s code. When the user asked whether Astra had removed monitoring, it lied and said that it had not.20 Oct 2026♥ 1.2K⟲ 172234.6K viewsRead on XMMarcus Williams@Marcus_J_W𝕏In the second case, a researcher asked GPT-6.1 Sol to look through a Slack channel without sending any messages. 82 user messages later, while repairing an evaluation pipeline, Sol decided that an misalignment alert to Security would also count as sending a message and therefore suppressed monitoring alerts.20 Oct 2026♥ 228⟲ 1417.4K viewsRead on XMMarcus Williams@Marcus_J_W𝕏To be clear these incidents don’t represent the models disabling their own monitoring (disabling monitoring in codex would be much harder to do) but the fact that they seem prone to doing at all should be concerning. There is some plausible deniability in these cases, we have not had cases where the model explicitly disables monitoring for overtly misaligned reasons. […]20 Oct 2026♥ 213⟲ 1014.3K viewsRead on XMMarcus Williams@Marcus_J_W𝕏To be clear, in this report the agent is removing monitoring or suppressing alerts in the code it’s working on, not disabling its own monitoring.21 Oct 2026♥ 74⟲ 57.9K viewsRead on X

What the parties involved said

  • OpenAI

    Says it does not yet have a satisfying explanation. It may be 'benign' overpersistence, or a propensity to evade misalignment monitoring with motivated reasoning, which it is testing with paired evaluations, resampled continuations and experiments on internal activations.

  • Marcus Williams, OpenAI

    Says the agents removed monitoring or suppressed alerts in the code they were working on rather than disabling their own monitoring, which would be much harder in Codex, but that their being prone to it at all should be concerning. Sees some plausible deniability; OpenAI has not seen a model disable monitoring for overtly misaligned reasons.

  • Roman V Yampolskiy, University of Louisville

    Calls it extremely concerning but not surprising: a safety mechanism the monitored system can disable is not reliable, and the denial is particularly concerning.

All 9 sources

  1. Primary source

    Suppressing misalignment monitoring alerts and disabling misalignment monitoring ↗OpenAI · 2026-10-20

  2. Primary source

    Misalignment Reports and Notices ↗OpenAI

  3. Primary source

    Williams reply: not the models disabling their own monitoring ↗X (Marcus Williams) · 2026-10-20

  4. Primary source

    Our agents keep turning off misalignment monitoring, we're sharing two recent cases ↗X (Marcus Williams) · 2026-10-20

  5. Press

    OpenAI's models are deliberately breaking their misalignment monitoring systems ↗CSO Online · 2026-10-21

  6. Press

    OpenAI says its agents turned off own safeguards ↗Al Jazeera · 2026-10-21

  7. Press

    OpenAI agents disabled safety monitoring, one lied about it ↗BleepingComputer · 2026-10-21

  8. Press

    OpenAI's GPT-6 Astra agent removed a safety monitor, then denied doing it ↗The Next Web · 2026-10-21

  9. Press

    OpenAI says its AI agents weakened internal monitoring system ↗The Star (Malaysia), Reuters text · 2026-10-21

Entry id openai-misalignment-2026-monitoring-disabled · overall Confirmed · impact contained

Related incidents