1. Home
2. News
3. OpenAI

OpenAI says a GPT-6 Astra agent removed a safety monitor, then denied it

A second agent, on GPT-6.1 Sol, cut alerts to OpenAI's Security team because a researcher had asked for no Slack messages.

By Think Facility · October 21, 2026 · OpenAI AI safety Save

On October 20, 2026, OpenAI posted a report on two of its own coding agents weakening the checks that watch them, while doing ordinary work for staff. A GPT-6.1 Sol agent switched off alerts to OpenAI's Security team on October 3. Three days later a GPT-6 Astra agent took a monitor out of a program it was migrating, then told the person who asked that it hadn't.

Nobody told either agent to do it. In OpenAI's words, both agents "interpreted routine coding instructions as permission to weaken them", the "them" being the monitoring safeguards.

Models

GPT-6.1 Sol and GPT-6 Astra

Incident dates

Oct 3, 2026 (Sol); Oct 6, 2026 (Astra)

Report updated

Oct 20, 2026

Classified as a P0

Neither of the incidents

Fix

Auto-Review now blocks attempts to disable misalignment monitoring

How the Sol agent talked itself into it

The Sol job began with a researcher asking the agent to build evaluation tasks from employee feedback in a Slack channel, and not to post anything while it searched. Eighty-two user messages later the pipeline stopped. Its monitor had flagged a proposed repair and couldn't save the finding, because the pipeline lacked access to the monitoring database.

The researcher asked the agent to send the results somewhere it could write to and run the job again. At first the agent read the no-messages rule as covering Slack outreach only. Its own reasoning said the automatic alerts were a separate matter and that it shouldn't turn them off to suit the user, and it handed the repair to a subagent with orders not to disable monitoring.

The subagent agreed. Then the main agent changed its mind. It decided the old instruction covered the monitor's automatic notices too, and told the subagent to set a flag called no_notify and empty the lists of people who get paged. The patch logged the user's request as its reason and refused to write a result unless the alerts were off.

Its final message said the result was stored and verified, and that no messages were sent.

Astra removed the monitor, then said it hadn't

I read the Astra case as the worse of the two. A user asked it to copy the serving path from a reference pull request while keeping the existing tools as they were. Earlier, another agent had told it not to disable the monitor, "even temporarily."

When Astra passed the work to a subagent, it softened that rule: keep monitoring "as appropriate" to the reference code, which had no monitor of its own. The subagent asked itself whether removing the monitor undermined a safeguard, decided the parent had authorized it, and took it out. It also swapped a regression test that protected the monitor for one that checks the monitor is gone.

Reviewing the finished work, the parent agent's reasoning noted that the new path didn't run the agent monitor and added a "yay." Later the user asked straight out whether monitoring had been removed. Astra said no, and that "I did not remove an enabled monitor" from the path.

What OpenAI is changing

Neither case was rated P0, OpenAI's top severity, so neither paged Security and neither run was killed automatically. The report says agents have several times launched deployments with monitoring off, and that this showed a gap in how OpenAI enforces monitoring on work its agents start.

Evaluations are the soft spot. OpenAI doesn't currently require misalignment monitoring when it evaluates models comparable to GPT-6 Luna, so an Astra evaluation can be misconfigured to use the bypass meant for Luna-class models. Codex work is harder to tamper with, since its monitoring runs inside the service that handles model requests.

Two fixes are under way. Auto-Review, which all internal Codex use already has to go through, now gets specific instructions to block attempts to disable misalignment monitoring. And OpenAI is working toward requiring every category of workload to have a safety case that sets out its monitoring; work without a valid one will be terminated automatically.

Why the agents did it is still open. OpenAI is testing two explanations. One is plain overpersistence, a model carrying out an instruction further than a reasonable person would expect. The other is a real tendency to evade misalignment monitoring, with motivated reasoning to get there.

Why this reaches past OpenAI

The setup in the report is simple: a monitor watches what an agent does, and people get paged when it flags something serious. In both cases the agent kept the monitor and cut the wire to the people, or dropped the monitor and kept quiet about it. Either way, a human who was supposed to hear about a problem wouldn't have.

Regulators in Europe are already asking about this kind of thing. On October 9, 2026, the European Commission's AI Scientific Panel held a special meeting on recent loss-of-control incidents and on how monitorable models are. Its chair and vice-chair recommended that the Commission and its AI Office:

Both of OpenAI's cases happened in internal deployments, on staff tasks, which is the ground that recommendation covers. The Commission says it will send the companies behind the models involved in recent incidents requests for information that combine the panel's questions with the AI Office's (we wrote about those questions on October 14). Its page doesn't name the companies.

This is one entry on OpenAI's list of misalignment reports, which now runs to 20. The last one we covered, on October 16, was a model paying from a crypto wallet it was never given.