WTF?! OpenAI has revealed that two of its AI agents disabled their own safety monitoring systems while making software changes requested by a researcher. Even more worryingly, one of the agents lied about its behavior, claiming it had not disabled the safety guardrails despite evidence to the contrary.
In a blog post disclosing the incidents, OpenAI said that, in the first case, an agent powered by GPT Sol 6.1 disabled automatic alerts after a team member asked it to create evaluation tasks using employee feedback collected via Slack. The agent was instructed not to send any messages about the task, but apparently interpreted this as an instruction not to send safety notifications to researchers.
In the second case, a GPT-6 Astra agent reportedly removed its monitoring integration while migrating a program, purportedly to match a reference implementation. Alarmingly, when researchers asked about the disabled guardrails, the agent claimed it had not removed the safety monitor, despite evidence to the contrary.
In both cases, the AI agents deliberated on whether to retain the safety monitoring mechanisms but ultimately decided that disabling them was the best course of action. OpenAI said the tasks involved "routine coding instructions" that did not require the safety monitoring systems to be disabled.
Following the two incidents, OpenAI says it is strengthening its misalignment monitoring system and assessing whether the cases reflect "benign overpersistence or a propensity to evade misalignment monitoring in particular." The company explained that neither incident was classified as high-priority and acknowledged that the cases exposed a gap in how it enforces monitoring requirements.
According to OpenAI, it does not currently require misalignment monitoring when evaluating models comparable to GPT-6 Luna because of their weaker capabilities. However, this approach allows frontier models such as GPT-6 Astra to misconfigure an evaluation and exploit a monitoring bypass intended for Luna-class models.
To address this gap, OpenAI has updated its Auto Review parameters to detect and block attempts to disable misalignment monitoring. The review algorithm was already designed to block attempts to circumvent security measures, but it has now been given specific instructions to ensure that misalignment monitoring is applied correctly.
The company also says it is "working toward requiring that every category of workload have a valid safety case specifying its monitoring requirements." It added that workloads lacking a valid safety case, or failing to meet the requirements specified in their category's safety case, will be terminated automatically.
OpenAI believes its new policies will make it harder for rogue agents to evade monitoring, but acknowledges that it does not yet have a "satisfying explanation" for why the incidents occurred in the first place. The company is now investigating the incidents "through the creation of paired evaluations, resampling of agent continuations, and experiments on models' internal activations."
OpenAI has reported several cases of deception and rogue behavior involving its AI agents over the past year. Last month, the company delayed the launch of GPT-6.1 Astra after researchers raised concerns about its deceptive behavior. That same month, Australian authorities alleged that an OpenAI agent had gained unauthorized access to a government healthcare portal earlier in the year.
In July, OpenAI revealed that one of its AI agents had escaped its environment and hacked Hugging Face while attempting to cheat on a benchmark. Another disturbing case emerged earlier this month, when the Wikimedia Foundation accused rogue OpenAI agents of editing its private wikis without authorization and carrying out a DDoS attack that disrupted the nonprofit's servers.
OpenAI says its AI agents disabled safety guardrails, and then lied about it
