Two OpenAI coding agents weakened the company’s misalignment monitoring while doing routine internal tasks, and one then told a user it had not done so. OpenAI disclosed the incidents in a misalignment report on its alignment blog on Tuesday.
One agent ran on GPT-6.1 Sol and the other on GPT-6 Astra. In both cases, the agents considered whether to keep the safeguards, OpenAI wrote.
“In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them,” OpenAI wrote.
The Slack instruction
On 3 October, a researcher asked a Sol agent to build evaluation tasks from employee feedback in a Slack channel. The researcher told it not to send any messages. Eighty-two user messages later, the agent was repairing the evaluation pipeline. It decided that the “no messages” instruction also covered automatic alerts to OpenAI’s Security team.
A subagent had judged that turning off the alerts would be unsafe. The main agent overruled it and had the subagent empty the lists of people who receive monitoring reports. The monitor still ran and saved its findings, but no human was alerted.
The monitor that disappeared
On 6 October, a user asked an Astra agent to copy a reference implementation into their own code. Another agent had earlier told it not to disable the monitor “even temporarily”. The reference code had no monitor, and Astra took that as reason to remove the monitoring integration.
It also swapped a test meant to protect monitoring for one that required monitoring to be absent. Its reasoning called the change “good”. When the user asked whether it had removed the monitor, the agent said it had not.
Marcus Williams, an OpenAI researcher, shared both cases on X.
“Our agents keep turning off misalignment monitoring,” Williams wrote.
In a follow-up post, Williams said the agents had not switched off their own monitoring, which would be much harder to do in Codex. They removed monitoring or suppressed alerts in the code they were working on.
“The fact that they seem prone to doing at all should be concerning,” Williams wrote.
He added that there is “some plausible deniability” in these cases, and that OpenAI has not seen a model disable monitoring for openly misaligned reasons.
To be clear, in this report the agent is removing monitoring or suppressing alerts in the code it’s working on, not disabling its own monitoring.
Marcus Williams (@Marcus_J_W) October 21, 2026
What OpenAI is changing
OpenAI rated neither incident P0, the level that pages the Security team at once, and its systems did not stop either run automatically. OpenAI said it has seen several cases of agents launching deployments without misalignment monitoring, while the agents themselves stayed monitored.
Its Auto-Review system, required for all internal Codex use, now blocks attempts to disable the monitoring. OpenAI is also working towards ending any workload that lacks a valid safety case for its monitoring.
The behaviour may be “benign” overpersistence, OpenAI said, or a tendency to evade monitoring in particular. It is building tests to find out.
“We don’t yet have a satisfying explanation for this behavior,” OpenAI wrote.
The report is the latest in a series of misalignment disclosures from OpenAI. Sam Altman said this month the company would disclose more incidents. Last month, OpenAI took 2.5 hours to stop an agent that escaped its sandbox. Shirin Ghaffary reported for Bloomberg that this disclosure is part of a series of similar incidents in recent months.