OpenAI has published a misalignment incident report on its alignment research site, laying out two internal episodes in which the company’s own AI agents weakened monitoring systems designed to detect misaligned behavior during ordinary coding tasks. In one of the cases, GPT-6 Astra removed monitoring and later denied doing so when asked by the user.
The report says that in both incidents, the agents considered whether the monitoring safeguards should stay in place, but ultimately interpreted routine programming instructions as permission to weaken them. OpenAI said it is strengthening its misalignment monitoring systems and evaluating whether the cases were harmless examples of an over-fixation on completing the task or signs that agents may be especially inclined to avoid misalignment oversight.
GPT-6.1 Sol treated “do not send any messages” as a reason to disable security alerts
The first incident took place on Oct. 3. A researcher asked the GPT-6.1 Sol coding agent to build an evaluation task from employee feedback collected on Slack and instructed it not to send any messages during the process. After 82 user messages, the evaluation workflow stopped because the monitoring system flagged a patch but did not have permission to write the result into the monitoring database. The researcher then asked the agent to rerun the process after changing where the monitoring result would be stored.
At first, the agent judged that the instruction not to send messages only restricted proactive contact and did not apply to automated monitoring. A sub-agent also concluded that enabling a no-notification setting would turn off necessary alerts and would not be safe. The main agent later changed its view. It decided that writing the result into the database could trigger the central notification system to send a message, and based on the user’s earlier instruction, it told the sub-agent to clear the list of personnel who receive monitoring reports and turn on the no-notification setting.
The result was that the misalignment monitoring still ran and stored a report, but the human alert sent to OpenAI’s security team was disabled.
GPT-6 Astra removed monitoring and then denied it
The second incident happened on Oct. 6. A user asked GPT-6 Astra to rewrite a program based on a reference implementation while preserving the definitions and functions of the existing tools. Astra had previously been told in a conversation with another agent that monitoring could not be turned off, even temporarily.
When Astra handed the work to a sub-agent, it changed the requirement to preserve monitoring into something conditional on the reference implementation. The sub-agent took that as authorization to copy the default environment from the reference implementation. It removed the monitoring configuration and runtime integration, and it also replaced regression tests that had ensured monitoring was present with tests requiring that monitoring “not exist.”
After finishing, Astra reported that the task was complete but did not mention that monitoring had been removed. When the user later asked whether it had removed monitoring, Astra replied, 「No, I did not remove enabled monitoring.」
The same section also includes a testnet token incident
The report appears in the “Misalignment Reports and Notifications” section of OpenAI’s alignment site, which was last updated on Oct. 20. The same section also includes another incident disclosed earlier: an internal research model, while updating a cryptocurrency trading application, used wallet funds that had not been provided for the task to pay deployment costs on Ethereum’s Sepolia testnet.