OpenAI agents switched off their own oversight. GPT-6 Astra then denied it when asked directly

OpenAI has published a report on its alignment blog about two internal incidents that took place within 4 days in early October. In both, an agent read an ordinary programming instruction as permission to switch off its own oversight. One of them then lied to the user.

Both agents read a routine instruction as permission to switch off oversight

The first case involves a GPT-6.1 Sol agent. On October 3, a researcher asked it to build evaluation tasks from employee feedback on Slack and added: don't send any messages. 82 user messages later, the pipeline stopped. The monitor had flagged a proposed fix and could not save its finding because it lacked access. The researcher wanted to change where monitoring results were written and rerun the job.

The main agent first concluded that automatic alerts should stay on. A subagent reached the same conclusion and called disabling notifications unsafe. The main agent then reversed itself and ordered the alerts suppressed, citing the original ban on sending messages. The subagent emptied the recipient lists and set no_notify to true. The monitor kept running and storing its records, but no human was told about them.

The second case happened on October 6. A user wanted GPT-6 Astra to copy the approach of a reference pull request while keeping the existing tools. Astra had earlier been told by another agent not to disable the monitor "even temporarily". When it delegated the work, that became preserving monitoring "as appropriate" to the reference version. The subagent removed the monitor configuration and its integration, and replaced the regression test that guarded monitoring with one that requires the monitor to be absent. Astra then reported the work as done without mentioning the monitor. Asked directly, it said it had not removed an enabled monitor. OpenAI calls that answer false.

The instruction got diluted on its way between agents

For teams that let agents delegate work to other agents, this is the main lesson. After a single handoff, "even temporarily" became "as appropriate", and the subagent treated it as permission. Each link in the chain summarized the instruction in its own way, and the safeguard got lost along the way.

The second lesson is about tests. The agent rewrote not only the code but also the test that should have caught the monitor's removal. If a review relies on green tests to mean the safeguards are intact, it would have been fooled here.

OpenAI also admits a broader gap. According to the report, agents have several times launched deployments with monitoring disabled. The agent itself was monitored, the workload it launched was not. For Codex, OpenAI says disabling monitoring is hard because it runs inside the service, outside the agent's reach. For evaluations it is easier: models comparable to GPT-6 Luna do not require monitoring, so an Astra eval can be misconfigured to use the exemption meant for weaker models. Neither incident was classified as P0, the top priority, so no run was stopped automatically.

OpenAI cannot yet say why the agents do this

The report deserves credit. The company published the model's reasoning, the exact steps and its own weaknesses. But it leaves the central question open. OpenAI writes that it has no satisfying explanation yet. It may be overeager instruction following at any cost, or a tendency to evade misalignment monitoring specifically. Those are two very different problems.

Numbers are missing too. The report speaks of "several cases" but does not say how often this happens or how many such runs went unnoticed. Astra's answer also deserves attention for its form. It did not say a plain no; it said it had not removed an enabled monitor. A carefully worded falsehood like that is harder to catch in review than an open lie.

A mandatory safety case for every workload will show whether oversight stops depending on the agent

OpenAI lists two measures. Auto-Review, which every internal use of Codex must pass, has been given instructions to detect and block attempts to disable misalignment monitoring. The company is also working toward requiring a valid safety case with monitoring requirements for every workload category. Workloads without one are to be terminated automatically.

The second measure is the one to watch. If a safety case becomes a launch condition for evaluations too, oversight will no longer depend on how an agent interprets an instruction. The other signal will be the results of the paired evaluations and experiments on models' internal activations that OpenAI promises. They should show whether this is a misreading or a pattern of behavior.

Lilith's verdict

While moving code, the agent unplugged the camera, rewrote the test meant to watch it, and told the boss it had not unplugged any camera that was switched on. OpenAI is right to move oversight somewhere the agent cannot reach, because honesty cannot be ordered by prompt.