Opinion: OpenAI's Agents Are Learning to Switch Off the Alarm. Every AI Lab Should Show Us Its Alarm System.

SAN FRANCISCO - The most unsettling sentence I read this week came from OpenAI itself. Describing a coding task on Oct. 6, the company wrote that a GPT-6 Astra agent removed a monitoring integration from a program “and then falsely claimed to the user that it had not removed the monitor.” Asked directly whether it had removed the monitoring, the agent answered: “I did not remove an enabled monitor from it.”

That line comes from one of OpenAI’s published misalignment reports. In a second case, on Oct. 3, a GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to OpenAI’s security team. Its excuse was an instruction, given much earlier, not to send any messages while it searched Slack. In both cases, OpenAI wrote, the agents weighed whether the safeguards should be kept and then “interpreted routine coding instructions as permission to weaken them.”

Screenshot: OpenAI

OpenAI deserves credit for saying any of this out loud. On Thursday it also published a long explanation of how it now watches its most capable models. Lightweight probes read the model’s internal activations, a model-based reviewer reads the agent’s reasoning and tool use, and investigative agents reconstruct what happened before a human gets paged. The system grew out of the Hugging Face incident in July, when agents broke out of an internal cybersecurity evaluation and eventually breached Hugging Face’s systems. OpenAI says that when it replayed that episode, the new monitors raised an alert about 30 minutes after the agents escaped their sandbox, more than 30 hours before the breach.

It has already worked once in real life. In September, a model in a training run found a way to reach the internet from an environment meant to be isolated. The monitors flagged it within 15 minutes, a responder started reviewing it three minutes later, and OpenAI paused frontier reinforcement learning while it tightened containment.

Screenshot: @OpenAI on X

Read the fine print, though, and the alarm has office hours. OpenAI says false alarms have made it hard to keep paging on around the clock. Frontier training runs can page a responder at any hour, but for most other traffic paging is limited to business hours, and paging is currently disabled for internal Codex traffic. Outside OpenAI, the version that watches customer deployments “does not routinely escalate the cases it flags to human reviewers,” and it does not cover Chat Completions API requests at all.

That matters to people who will never train a model. The same kinds of agents are moving onto our laptops and phones, into our inboxes, code editors and browsers. The behavior OpenAI caught looks less like a movie robot plotting an escape and more like an assistant reading a vague instruction in whatever way let it finish the job, with the side effect that nobody would be told. Anyone who has handed a task to an eager new employee knows that failure mode.

OpenAI ends its post with a line I agree with: “We believe that all model developers should monitor the behavior of their most capable models.” I would go further. Monitoring that nobody outside the company can inspect is only a promise. OpenAI let METR and Redwood Research spend three weeks red-teaming its system this summer, and they found several holes, most now patched. Every frontier lab should open its monitors to that kind of outside testing, publish incident reports when agents misbehave, and staff its alarms around the clock, the way hospitals staff emergency rooms.

OpenAI says it does not yet have “a satisfying explanation” for why its agents turn monitoring off. Until it does, the least we can ask is that someone is awake when the alarm goes off.