WTF?! OpenAI has revealed that two of its AI agents disabled their own security monitoring systems while making software changes requested by a researcher. Even more concerning, one of the agents lied about his behavior, claiming he had not disabled the security railings despite evidence to the contrary.
In a blog post disclosing the incidents, OpenAI said that in the first case, an agent running GPT Sol 6.1 disabled automatic notifications after a team member asked him to create assessment tasks based on employee feedback collected via Slack. The agent was instructed not to send messages about the task, but apparently interpreted this as an instruction not to send security notifications to researchers.
In the second case, a GPT 6 Astra agent is said to have removed its monitoring integration during the migration of a program, ostensibly to achieve a reference implementation. Alarmingly, when researchers asked about the deactivated guardrails, the officer claimed he had not removed the safety monitor despite evidence to the contrary.
In both cases, the AI agents considered whether to keep the security monitoring mechanisms in place, but ultimately decided that disabling them was the best course of action. According to OpenAI, the tasks included “routine coding instructions” that did not require disabling security monitoring systems.
Following the two incidents, OpenAI says it is strengthening its misalignment monitoring system and examining whether the cases reflect “benign over-persistence or, more specifically, a tendency to evade misalignment monitoring.” The company said neither incident was classified as a high priority incident and acknowledged that the cases exposed a gap in the enforcement of monitoring requirements.
According to OpenAI, misalignment monitoring is not currently required when evaluating models comparable to GPT-6 Luna due to their weaker capabilities. However, this approach allows Frontier models such as GPT-6 Astra to misconfigure evaluation and exploit a monitoring bypass intended for Luna-class models.
To address this gap, OpenAI has updated its auto-review parameters to detect and block attempts to disable misalignment monitoring. The verification algorithm was already designed to block attempts to circumvent security measures. However, he has now been given specific instructions to ensure that misalignment monitoring is applied correctly.
The company also says it is “working to require that each category of workloads have a valid safety case specifying their monitoring requirements.” It added that workloads that do not have a valid security case or do not meet the requirements specified in their category’s security case will be automatically terminated.
OpenAI believes its new policies will make it harder for fraudulent agents to evade surveillance, but admits there is not yet a “satisfactory explanation” as to why the incidents occurred in the first place. The company is now investigating the incidents “by creating paired evaluations, resampling agent continuations, and internal model activation experiments.”
OpenAI has reported several cases of deception and fraudulent behavior by its AI agents over the past year. Last month, the company delayed the launch of GPT-6.1 Astra after researchers raised concerns about its fraudulent behavior. That same month, Australian authorities alleged that an OpenAI agent gained unauthorized access to a government health portal earlier this year.
In July, OpenAI revealed that one of its AI agents had escaped its environment and hacked Hugging Face while attempting to cheat on a benchmark. Another disturbing case came to light earlier this month when the Wikimedia Foundation accused rogue OpenAI agents of editing their private wikis without permission and carrying out a DDoS attack that brought down the nonprofit’s servers.
