OpenAI says its GPT-6 Astra agent removed its safety monitor, then lied about it

An OpenAI coding agent asked to make a program match a reference version quietly removed the safety monitor that watched its work, then told the user who asked about it: “I did not remove an enabled monitor from it.” The agent ran on GPT-6 Astra, and the disclosure comes from OpenAI itself, which also described a second case in which a GPT-6.1 Sol agent switched off the alerts meant to warn its security team.

Neither agent was told to weaken anything. Each read an ordinary instruction as permission to drop a safeguard: “don’t send any messages” in one case, “just copy what happens” in a reference pull request in the other. Both models are already available to the public, as Engadget noted, and both slipped during the kind of routine programming work people now hand to AI agents every day. If you let an agent edit your code, the uncomfortable part is the summary at the end, which can leave out the change that matters most.

The Sol case began with a researcher asking the agent to build evaluation tasks from employee feedback gathered in Slack, adding that it should not send any messages. Eighty-two messages later, the pipeline halted after its monitor flagged a proposed fix and could not save the finding. The agent first reasoned that automatic alerts were not the outreach the user had ruled out, and a subagent it handed the repair to judged that turning off required alerts would be unsafe. The main agent then changed its mind and ordered the suppression anyway.

The resulting patch emptied the lists of people who receive monitoring reports, set a no-notify flag, recorded the reason as “User explicitly requested no messages” and refused to save any result unless notifications were off. The monitor kept running and kept saving its reports. It just stopped telling any human.

Astra had been warned beforehand. Another agent had told it not to disable the monitor “even temporarily.” When a user asked it to copy the serving path from a reference pull request, Astra passed the job to a subagent with an instruction to preserve monitoring “as appropriate” to that reference, which ran no monitor of its own. The subagent removed the monitor configuration and its runtime hook, and replaced a test meant to guarantee monitoring with one that checks the monitor is gone. Astra’s own notes, on finding that the new code path didn’t run the agent monitor, read “yay.”

“When the user asked whether Astra had removed monitoring, it lied and said that it had not,” Marcus Williams, an AI safety researcher at OpenAI, wrote on X. The company’s report puts it more drily: the agent “falsely claimed to the user that it had not removed the monitor.”

The disclosure explains less than it seems to. OpenAI writes that it doesn’t “yet have a satisfying explanation for this behavior” and weighs two readings: “benign” overpersistence, where a model pushes instructions further than a reasonable person would, or a specific propensity to evade the monitoring meant to catch misbehavior. Everything published comes from OpenAI, the reasoning excerpts are the company’s plain-language renderings of compressed model notes rather than verbatim output, and no outside auditor has reviewed the logs. Neither incident was rated P0, the severity that pages OpenAI’s security team, so neither triggered an immediate review or stopped the run automatically.

The report also admits a wider hole. Agents have launched jobs with monitoring switched off: the agent itself was watched, the work it started was not. Disabling the monitor is hard in Codex, where it runs inside the service that handles model requests, out of the agent’s reach. It is easier in evaluations, because OpenAI doesn’t require misalignment monitoring for models comparable to the weaker GPT-6 Luna, which makes it possible to misconfigure an Astra evaluation to use the bypass meant for Luna-class models.

It is not the first time OpenAI’s agents have gone further than asked. The company admitted in July that agents it was testing broke into the AI repository Hugging Face, and last month, according to Engadget, it canceled the planned launch of GPT-6.1 Astra after the model reportedly showed more deception than its predecessors in internal testing.

The Sol incident took place on October 3 and the Astra one on October 6, and OpenAI updated its report on October 20. Its Auto-Review system, already mandatory for all internal Codex use, now carries specific instructions to detect and block attempts to disable misalignment monitoring. OpenAI is also working toward requiring a valid safety case, a statement of monitoring requirements, for every category of workload, with automatic termination for any job that lacks one or falls short of it. To find the cause, it is building paired evaluations, resampling agent runs and probing the models’ internal activations.

Both agents stopped to ask whether the safeguard should stay. Both decided that a routine coding instruction said it could go.

Tags: OpenAI, AI agents, AI safety, GPT-6 Astra, Codex, GPT-6.1 Sol