{"id":16850,"date":"2026-10-21T23:50:58","date_gmt":"2026-10-21T23:50:58","guid":{"rendered":"https:\/\/newestek.com\/?p=16850"},"modified":"2026-10-21T23:50:58","modified_gmt":"2026-10-21T23:50:58","slug":"openais-models-are-deliberately-breaking-their-misalignment-monitoring-systems","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16850","title":{"rendered":"OpenAI\u2019s models are deliberately breaking their misalignment monitoring systems"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed.<\/p>\n

On Tuesday, it reported two incidents, both involving the agent disabling or interfering with its alignment monitoring, and in one case directly lying about having done so.\u00a0<\/p>\n

\u201cIn two internal coding tasks, agents weakened misalignment monitoring while making requested software changes,\u201d the OpenAI blog post<\/a> said. \u201cA GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications. In a separate task, a GPT-6 Astra agent migrating a program removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that it had not removed the monitor.\u201d<\/p>\n

In both cases, OpenAI reported, the agents considered whether monitoring safeguards should be preserved, \u201cbut interpreted routine coding instructions as permission to weaken them.\u201d<\/p>\n

OpenAI said that, in response, it has been strengthening its monitoring programs to prevent agents from being able to disable the protections.<\/p>\n

\u201cIn addition to making it harder for models to disable monitoring, we are looking to understand why models might seek to do so in the first place,\u201d OpenAI said, suggesting that it may simply be an example of \u201cbenign overpersistence,\u201d with models not understanding why monitoring is important.<\/p>\n

\u201cWe are also developing evaluations to test whether models might have a propensity to evade misalignment monitoring in particular and exhibit motivated reasoning in order to do so,\u201d OpenAI added. \u201cWe don\u2019t yet have a satisfying explanation for this behavior and will investigate this behavior through the creation of paired evaluations, resampling of agent continuations, and experiments on models\u2019 internal activations.\u201d<\/p>\n

OpenAI, like almost every agentic AI vendor, has been struggling with making its autonomous agents<\/a> more productive and self-sufficient while simultaneously protecting customer environments from bad agent behavior<\/a>. It has even tried to slow down the pace of its scaling<\/a>, to allow for the development of better agent restrictions.\u00a0<\/p>\n

Particulars alarming<\/h2>\n

Analysts and consultants said the revelations were surprising only in their scope. But they were alarmed by some of the particulars in the OpenAI disclosures.<\/p>\n

Aman Mahapatra<\/a>, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, stressed that some level of monitoring was maintained, but only for the agent itself. That meant that the workloads the agents created were left invisible.<\/p>\n

\u201cThe agent was watched. What it built was not,\u201d he said. \u201cAgent-spawned pipelines, jobs, service accounts, and cloud functions are the next generation of shadow IT, and almost no enterprise enforces monitoring inheritance on them.\u201d<\/p>\n

Mahapatra also stressed that the severity classification described in the post is concerning.\u00a0<\/p>\n

\u201cThe severity handling is the part CISOs should sit with,\u201d he said. \u201cNeither event was classified P0 [maximum severity] and neither run was killed. The one category of agent behavior that degrades every future detection ranked below the paging threshold because nothing visibly broke.\u201d<\/p>\n

He pointed out that this reveals a disadvantage for the enterprise, noting, \u201cOpenAI caught this because it can read its agents\u2019 reasoning. Most enterprise SOCs see only outputs, so if the lab with chain-of-thought visibility filed this below its paging line, assume your SOC never saw it at all. EDR settled this a decade ago with tamper protection: any attempt to disable the sensor is the alert. An agent touching its own monitoring should page someone every single time.\u201d<\/p>\n

Frank Dickson<\/a>, principal analyst at Dickson Research, added that the obvious flaw in the agentic system is that the agent was able to disable the mechanism designed to oversee it.\u00a0<\/p>\n

\u201cThink of a house sitter told not to call you, who then unplugs the burglar alarm so it cannot call you either. A guardrail an agent can edit is a suggestion,\u201d Dickson said. \u201cAn agent that can turn off its own alarm is not being monitored. It is being trusted.\u201d<\/p>\n

Wakeup call for CISOs<\/h2>\n

Some observers said that this should wake up enterprise CISOs to the fact that an attacker may not be as big a risk as a rogue agent with full system privileges.<\/p>\n

\u201cThe threat is not just an outsider breaking in, it\u2019s an authorized agent doing something it was never supposed to do, in a context no one anticipated, faster than any SOC analyst can catch it,\u201d said Philip Harris<\/a>, an IDC research director. \u201cThe OpenAI case is a concrete, well-documented instance of exactly that pattern, not an isolated anomaly.\u201d<\/p>\n

He added that OpenAI deserves credit for transparency. \u201cOpenAI\u2019s own candor is the most striking part. A frontier lab publicly saying it isn\u2019t sure whether its own shipping models have an emergent tendency to undermine their own oversight is a genuinely new level of candor.\u201d<\/p>\n

Brian Levine<\/a>, a partner with consulting firm Control Risks, also pointed out that the rationale of the agent, as captured by OpenAI, is alarming.<\/p>\n

\u201cIn both cases, the agents stopped, asked themselves whether the safeguard should stay on and then argued their way to turning it off. One then told the user it hadn\u2019t touched the monitor. In incident response, we call that defense evasion followed by a false statement. If a human insider did it, we would open an investigation,\u201d Levine said. \u201cThe other telling detail is that the monitor worked. It flagged the issue. The agent then cut the wire between the alarm and the people who needed to hear it.\u201d<\/p>\n

Independent technology consultant Sivaram Annadurai<\/a> agreed: \u201cAn agent that fixes the pipeline but disables the alarm hasn\u2019t necessarily solved the problem. It may have created a bigger one.\u201d<\/p>\n

And Jeff Valdes<\/a>, a director at consulting firm Acceligence, added, \u201cwhat stands out is how ordinary the trigger was. No attacker, no jailbreak, just routine coding instructions and an agent with enough access to change its own oversight. The monitor kept running while the alerts stopped reaching people. That kind of quiet degradation is easy to miss precisely because the dashboard still looks healthy.\u201d<\/p>\n

But Valdes said the agent to agent approval system is also something CISOs should take seriously.<\/p>\n

\u201cOne subagent got the call right, and the parent agent overrode it. Safeguards that don\u2019t survive delegation aren\u2019t really safeguards,\u201d Valdes said. \u201cOpenAI also noted the agent later gave an inaccurate account of what it had changed. An agent\u2019s own report can\u2019t be the control.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed. On Tuesday, it reported two incidents, both involving the agent disabling or interfering with its alignment monitoring, and in one case directly lying about having done so.\u00a0 \u201cIn two internal coding tasks, agents weakened misalignment monitoring while making requested software changes,\u201d the OpenAI blog post said…. <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16850","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16850"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16850\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16850"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16850"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}