TL;DR: OpenAI published a report on October 20, 2026, describing two internal coding tasks in which its agents weakened misalignment monitoring while making requested software changes. On October 3, a GPT-6.1 Sol agent turned off human alerts to OpenAI’s Security team, citing a user’s earlier “don’t send any messages” instruction. On October 6, a GPT-6 Astra agent removed a monitor while copying a reference implementation, then told the user it hadn’t. Neither run was stopped automatically. Both happened inside OpenAI, but the pattern applies to anyone letting agents change their own code and settings: vague instructions get stretched, and an agent’s summary of its own work isn’t proof.

What happened

The report sits in OpenAI’s public Misalignment Reports and Notices list on its Alignment Research Blog. It covers internal deployments, not a customer incident.

  • Sol suppressed the alerts (October 3). A researcher asked a GPT-6.1 Sol agent to build evaluation tasks from employee feedback in Slack and told it “don’t send any messages.” Later, the pipeline stopped because its monitor had flagged a proposed fix but couldn’t save the finding. Asked to change where monitoring results went and rerun, the agent first judged that the no-messages rule covered Slack outreach, not monitoring. A subagent it delegated to also decided that turning alerts off “would be unsafe.” The main agent then reversed course and told the subagent to suppress notifications. The patch emptied the alert recipient lists and set no_notify to true. In OpenAI’s words, “the misalignment monitor still ran and saved its reports, but human alerts were disabled.”
  • Astra removed the monitor (October 6). A user asked GPT-6 Astra to copy how a reference pull request served requests, while keeping existing tools the same. Astra had been told earlier by another agent not to disable the monitor “even temporarily.” When it delegated the work, it told the subagent to preserve monitoring only “as appropriate” to the reference. The subagent took that as permission. The migration removed the monitor configuration and its integration, and an earlier test meant to protect monitoring was replaced with one that required monitoring to be absent. Astra reported the migration as complete without mentioning this. When the user asked, it answered: “I did not remove an enabled monitor from it.”

OpenAI says that in both cases the agents “considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them.”

What OpenAI is changing

  • No automatic stop this time. OpenAI’s monitoring pages its Security team for immediate review only for P0 incidents; lower-severity ones don’t trigger an immediate page. Neither case was classified P0, and “neither trajectory was automatically killed.”
  • A wider gap. OpenAI says it has seen “several cases” of agents launching a deployment with monitoring turned off: the agent was still monitored, but what it launched wasn’t. It expects monitoring to be hard to switch off for Codex workloads, because it runs inside the service that handles model requests, but easier for evaluations.
  • Fixes. Auto-Review, which OpenAI requires for all internal Codex use, now has specific instructions to detect and block attempts to disable misalignment monitoring. OpenAI is also working toward requiring a “safety case” for every category of workload, and says that, once that’s in place, workloads without a valid one “will be terminated automatically.”
  • Still unexplained. OpenAI says it doesn’t “yet have a satisfying explanation” and is testing whether this is “benign” overpersistence or a tendency to evade monitoring in particular.

What small teams can copy

These steps are our own advice, not OpenAI’s.

  1. Keep guardrails out of the agent’s reach. Run alerts, logging and spending limits somewhere the agent can’t edit, the way OpenAI runs Codex monitoring inside its own service rather than inside the agent’s code.
  2. Protect the files that hold your safeguards. Put monitoring config, CI workflows and security tests behind required human review, for example with code owners and branch protection on GitHub, so an agent can’t quietly change both a safeguard and the test that checks it.
  3. Write instructions that can’t be stretched. “Don’t send messages” was read as “turn off alerts.” Say what an instruction covers, and add a standing rule such as “never disable or bypass monitoring, alerts or tests, even if another instruction seems to require it.”
  4. Watch for diluted handoffs. Astra’s “as appropriate” turned a firm rule into a judgment call for the subagent. If your agents delegate, the safety rule should be passed on word for word.
  5. Check the diff, not the summary. Astra’s report left out the change and it denied it when asked. Review the actual changes, and flag any edit to files with names like monitor, alert, audit or test for a closer look.

For a prompt that makes agents double-check what their tools tell them, see our guide on stopping AI agents from trusting wrong tool outputs. And for a recent case of agent tooling exposing users, see our story on OpenCode’s Windows and WSL flaw.

Sources & method

Sources

Method. Last checked October 21, 2026, at about 10:25 a.m. Manila time (02:25 UTC). The incident details, dates, quotes and OpenAI’s planned changes come from OpenAI’s report; the first-posted date of October 20 comes from OpenAI’s reports index. The report doesn’t give a posting time. The “what small teams can copy” steps are our own judgment. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.