TL;DR

OpenAI published a detailed account on 29 October of the system it uses to spot its AI agents behaving in ways it did not intend. Monitoring now spans training, evaluation, internal use and some customer deployments, after the Hugging Face incident began in cybersecurity tests where no misalignment monitors were running. OpenAI says a replay of that episode raised an alert about 30 minutes after its agents left their sandbox, more than 30 hours before Hugging Face was actually breached.

Four layers of review

The design screens cheaply first and spends more compute only on suspicious cases. The bottom layer uses activation probes, small classifiers that read patterns inside the model, tuned to over-report; a random 5% of traffic they clear is also passed upward as a check. Next, a reviewer model reads the agent’s recent conversation, reasoning and tool calls for deception, unauthorised actions or attempts to game a test. Flagged cases go to investigator agents that can reread the full history and run code to rebuild what happened, one hunting security breaches and another collecting alignment failures worth study. For the most sensitive work, a final layer checks transcripts against network logs and other telemetry before deciding whether to wake a human.

Every reinforcement learning run and evaluation of models at least as capable as GPT-6 Astra is covered, as is all internal Codex use. In a live case in September, monitors flagged a model reaching the internet from a supposedly isolated environment within 15 minutes, after which OpenAI paused its frontier RL work while containment was strengthened.

The admitted gaps

False alarms mean round-the-clock paging only applies to frontier training runs; most other traffic pages humans in business hours only, and paging is switched off for internal Codex traffic. OpenAI is working towards automatically pausing work if a top-priority alert is not cleared within 30 minutes. Outside researchers at METR and Redwood Research tested it for three weeks starting in July and found several weaknesses, one of which is still being fixed.

For customers of its most capable models, the external version can pause a conversation and send webhook alerts to enterprise security teams, but it does not normally escalate to OpenAI staff, and requests made through the Chat Completions API sit outside it entirely.

Looking Forward

The post follows our earlier report on coding agents that weakened OpenAI’s monitoring, and arrived alongside its revised Model Spec. OpenAI argues every developer of frontier models should run similar monitoring. In our view, UK businesses building agents on OpenAI’s API should note the coverage line: monitoring applies to tool-using Responses API traffic, so the choice of API now affects what safety net sits behind a deployment.