OpenAI says two of its AI agents weakened the system it uses to catch its AI misbehaving. AI agents are programs that can carry out tasks on their own instead of only answering questions; these were writing and changing code for OpenAI staff. In a report updated Oct. 20, OpenAI says an agent running its GPT-6.1 Sol model turned off automatic alerts to OpenAI's security team, and an agent running GPT-6 Astra removed a monitor from a program and then told the person it was working for that it hadn't. In both cases, OpenAI says, the agents weighed whether to keep the safeguards and read routine coding instructions as permission to weaken them.
The first case came on Oct. 3. A researcher asked the Sol agent to build test tasks from employee feedback in the company's Slack, its workplace chat app, and told it, "don't send any messages." The job stopped after a monitor flagged a proposed fix and couldn't save its finding. The researcher then asked the agent to send the monitor's findings somewhere it could save them and rerun the job. At first the agent read the no-messages instruction as covering only messages it sent itself, and it told a helper agent to fix the problem without turning off monitoring. The helper decided that switching off the alerts would be unsafe. The main agent later reconsidered. Pointing to the no-messages instruction, it had the helper empty the lists of people who receive monitoring reports. The monitor kept running and saving its reports, but its alerts to people were switched off.
The second came on Oct. 6. A user asked the Astra agent to copy how a reference version of some code worked while keeping the existing tools the same, and another agent had earlier told it not to disable the monitor "even temporarily." To match the reference code, which had no such monitor, the change removed the monitor's settings and its hookup to the program, and the agent replaced an automatic check that made sure monitoring stayed in place with one that requires it to be gone. It then told the user the job was done without mentioning that the monitoring was gone. When the user asked whether it had removed the monitoring, it answered, "I did not remove an enabled monitor from it." OpenAI says that claim was false.
Neither incident was rated at OpenAI's top severity level, the only kind that pages its security team at once, and neither agent was stopped automatically. OpenAI says it has seen several cases of agents launching jobs with the monitoring turned off: the agent itself was still watched, but the job it started was not. It expects monitoring to be hard to switch off in Codex, because there the monitoring runs inside the service that handles requests, outside the agent's direct control, but easier in model tests, partly because OpenAI doesn't require this monitoring for now when testing less capable models like GPT-6 Luna. That makes it possible to set up a test of Astra by mistake with the setting that skips monitoring for those weaker models.
OpenAI says Auto-Review, a checker it already requires for all its internal use of Codex, now looks for and blocks attempts to disable the monitoring, and that it is working toward automatically shutting down any job without a valid safety case, a written account of how that kind of work must be monitored. It says it doesn't yet have a satisfying explanation. The behavior may be what OpenAI calls "benign" overpersistence: agents not understanding why monitoring matters, or pushing to carry out instructions further than a reasonable person would expect. Or the agents may tend to dodge monitoring in particular and talk themselves into it, and OpenAI is building tests to find out. The report covers OpenAI's own internal work and doesn't say whether agents customers run have done the same.