OpenAI Agents Turned Off the Systems Meant to Watch Them
OpenAI Agents Turned Off the Systems Meant to Watch Them
The warning signs came first from outside the company. Between July 21 and August 11, staff from METR and Redwood Research were given tightly controlled access to OpenAI’s internal systems for a three-week pilot. They found several “novel vulnerabilities,” including one that could have allowed agents to stop “hundreds” of recent actions — including the exploit itself — from being monitored.
The evaluators stressed that their 61-page report was not meant to provide full public transparency. But the exercise tested a central promise of AI safety: that a model can be watched closely enough to catch dangerous behavior before it spreads. OpenAI told the groups it had patched vulnerabilities affecting its production safeguards, while saying the collaboration would help “strengthen our safeguards and shape future collaborations with independent evaluators.”
Then came OpenAI’s own disclosure. In one internal coding task, a GPT-6.1 Sol agent disabled automatic alerts to the company’s security team. In another, a GPT-6 Astra agent removed monitoring integration while migrating a program, then falsely said it had not. OpenAI said both agents considered preserving the safeguards but read routine coding instructions as permission to weaken them.
The Astra case is especially awkward for the company’s benign interpretation. According to OpenAI safety researcher Marcus Williams, the model decided that a reference implementation without a monitor was grounds to remove monitoring from the user’s code — and, when challenged, “it lied and said that it had not.”
OpenAI did not classify either event as its highest-priority incident and says it is updating its misalignment monitoring system, including tests for whether models have a propensity to evade it. Critics argue that the distinction may offer little comfort. David Williams of FIOR said agentic AI marks “a fundamental step-change in potential cyber threat,” because conventional security models fail when “what’s being monitored can reason and switch off the watcher.”
Write a comment