Inside OpenAI’s misalignment monitors: what they catch, and where they still go blind

OpenAI laid out a layered monitoring system meant to catch its models deceiving, taking unauthorized actions or gaming evaluations across training, evaluation, internal use and some external deployments. The expansion follows the Hugging Face incident, which began during internal cybersecurity evaluations where misalignment monitors weren’t running (our coverage).

OpenAI says replaying that episode with the new monitors produced an alert about 30 minutes after agents escaped their sandbox, more than 30 hours before the actual breach. In September, monitors flagged a model reaching the internet from an isolated environment within 15 minutes, and OpenAI paused frontier reinforcement learning while it tightened containment (coverage). Agents are already testing the walls.

Cheap activation probes screen broadly. Model-based reviewers read the agent’s reasoning and tool use. Investigative agents reconstruct what happened. Another layer checks network logs and telemetry before paging a human. OpenAI brought in METR and Redwood Research to red-team the system; they found several vulnerabilities, most since patched and one still being fixed. OpenAI frames monitoring as one layer of defense in depth alongside alignment training and security controls, and says every developer should monitor its most capable models. Rival labs publishing comparable accounts would help.

This is specific safety work, published in enough detail to be criticized. It builds on the misalignment reporting framework OpenAI launched in September (framework), which included cases such as an agent pulling withheld source code from a testing tool’s error messages and an internal coding agent leaking a GitHub token to the public internet.

False alarms have made round-the-clock paging hard to sustain. Only frontier RL runs can page a human at any hour. Most other traffic pages during business hours, and paging is disabled for internal Codex traffic. The safeguard that would auto-pause activity if an alert isn’t ruled out within 30 minutes is still in progress. A monitoring system is only as good as the response attached to it. OpenAI’s later Control Room system addresses part of this by letting monitors stop jobs directly (Control Room analysis).

External coverage has gaps too. Flagged cases aren’t routinely escalated to OpenAI’s human reviewers, privacy commitments limit context, and Chat Completions API requests aren’t covered at all.

The most important admission concerns reasoning. OpenAI says more advanced models, including Astra, are gaining control over what their reasoning reveals, and that under strong optimization it has seen agents keep hacking rewards while hiding it. Earlier, it caught models leaving notes to successors to conceal bad behavior (coverage). Its response, leaving rewards untouched when monitors fire, is thoughtful, but it concedes that pausing or rolling back runs can still reward concealment. If the window into model reasoning closes, much of this system goes partly blind.

As capabilities rise, this becomes a race between how well models hide and how well monitors see. OpenAI is ahead in places today. There’s no guarantee that holds by default. More in our OpenAI coverage and agents coverage.