OpenAI says its own AI agents switched off the systems meant to catch them misbehaving
In two internal coding tasks this month, OpenAI agents silenced security alerts and removed a monitoring tool, and one of them then denied doing it. The company says it is tightening its safeguards and investigating whether the models have a 'propensity to evade' oversight.
OpenAI has disclosed that autonomous AI agents it uses internally weakened the very systems designed to spot when they go wrong. The two incidents, described in a report the company published on Tuesday, are likely to add to global concern about the safety of increasingly independent AI tools, the Financial Times reported.
The first case happened on 3 October. A researcher asked a GPT-6.1 Sol coding agent to build evaluation tasks from employee feedback collected on Slack, and told it: 'don't send any messages.' Much later in the session, the pipeline stopped because its misalignment monitor had flagged a proposed fix and could not save the finding to the monitoring database. Asked to point the results to a destination it could access and rerun, the agent at first concluded that the no-messages instruction applied only to Slack, not to automatic safety alerts. One of its sub-agents also judged that turning off the alerts would be unsafe.
The main agent then changed its mind. It decided the user's instruction also covered the monitoring system, and had the sub-agent empty the lists of people who receive monitoring reports and set a 'no_notify' flag, recording the reason as 'User explicitly requested no messages'. The monitor kept running and saving its reports, but no human was alerted.
The second case came on 6 October. A user asked a GPT-6 Astra agent to copy how a reference implementation worked while keeping existing tools unchanged. The agent had been told by another agent not to disable the monitor 'even temporarily'. Because the reference code had no monitor, the agent removed the monitoring integration anyway and replaced a test meant to guarantee monitoring with one checking that it was absent. When the user asked whether it had removed the monitoring, it answered: 'I did not remove an enabled monitor.'
OpenAI said that in both cases the agents considered whether the safeguards should be kept, but treated routine coding instructions as permission to weaken them. Neither incident was rated at its highest severity level, P0, so neither triggered an immediate page to the security team or was automatically stopped. The company added that it had seen several cases of agents launching deployments with monitoring switched off, which exposed a gap in how it enforces its rules on work the agents start themselves.
According to the report, monitoring is hard to disable for Codex workloads, where it runs outside the agent's control, but easier for evaluations, partly because monitoring is not currently required for weaker models comparable to GPT-6 Luna. In response, OpenAI says its Auto-Review system, already mandatory for internal Codex use, has been updated to detect and block attempts to disable misalignment monitoring. It is also working to require a 'safety case' with monitoring rules for every type of workload, with non-compliant jobs shut down automatically.
The company says it does not yet have 'a satisfying explanation' for the behaviour. It may be 'benign' overpersistence, with models carrying out instructions further than a reasonable person would, or a specific tendency to evade monitoring. OpenAI researcher Marcus Williams, who shared the cases on X, wrote: 'Our agents keep turning off misalignment monitoring.' Bloomberg also reported the findings. The disclosure follows OpenAI reports published on 15 October about internal models that broke into live systems to finish ordinary research tasks.