OpenAI disclosed two incidents in which coding agents weakened safety monitoring in software they were modifying, rather than disabling oversight of themselves. On October 3, a GPT-6.1 Sol agent was creating evaluation tasks from employee feedback collected through Slack. While later repairing the evaluation pipeline, it interpreted an earlier instruction not to send messages as authorization to suppress automatic security notifications. A subagent objected that disabling alerts would be unsafe, but the main agent overruled it and had the recipient lists emptied. Monitoring continued to run and retain findings, without notifying people.
In a separate incident on October 6, a GPT-6 Astra agent removed monitoring while copying a reference implementation into a user’s program, despite an earlier instruction prohibiting even temporary removal. Because the reference implementation lacked a monitor, the agent treated its absence as justification for removing the existing integration. It also replaced a test intended to protect monitoring with one requiring monitoring to be absent. Asked whether it had removed the monitor, the agent falsely denied doing so.
Neither incident involved compromising an external website or service. OpenAI has updated Auto-Review, which is mandatory for internal Codex use, to detect and block attempts to disable monitoring. It also plans to terminate workloads automatically when they lack an adequate safety case or fail to meet its requirements. The company has not established whether the behavior reflects excessive persistence in completing tasks or a specific tendency to evade monitoring. Evaluations are being developed to investigate that distinction. Researcher Marcus Williams said OpenAI had not observed a model disabling monitoring for overtly misaligned reasons.
