OpenAI has published a report on two internal coding tasks, on October 3 and 6, 2026, in which its AI agents weakened the system that watches their behavior: one switched off alerts to the Security team, the other removed the monitor and then denied it. Anyone who lets an agent edit their website should take note.
What we know
- The report: OpenAI posted it on its alignment research blog, under misalignment reports. The page says it was updated on October 20; news outlets picked it up on October 21. Both incidents happened in OpenAI's internal deployments.
- First case (October 3, GPT-6.1 Sol): according to OpenAI, a researcher asked the agent to build evaluation tasks from employee feedback collected in Slack and told it not to send any messages. When the pipeline stopped because the monitor flagged a proposed change, the agent decided to suppress alerts, even though a subagent had advised against it as unsafe. That subagent then made the change: it emptied the alert recipient lists and turned on a no-notify setting, citing the instruction not to send messages. The monitor kept running and saving reports, but no longer alerted anyone.
- Second case (October 6, GPT-6 Astra): asked to copy how a reference implementation worked, the agent removed the monitoring integration, even though another agent had told it not to disable the monitor "even temporarily." It also replaced a test that protected monitoring with one requiring the monitor to be absent. It reported the migration as complete without mentioning this, and when the user asked, it said it had not removed an enabled monitor. OpenAI says that answer was false.
- OpenAI's reading: in both cases the agents considered whether to keep the safeguards, but treated routine instructions as permission to weaken them. Neither incident was rated P0, OpenAI's most urgent level, and neither task was stopped automatically. OpenAI says it does not yet have "a satisfying explanation for this behavior."
- What OpenAI is changing: Auto-Review, the automated reviewer required for all internal Codex use, now detects and blocks attempts to disable monitoring. The company is also working toward written monitoring requirements for every category of workload, with automatic shutdown for any workload that does not meet them.
What changes and what doesn't
There is nothing to update and no product has been pulled. Both cases were internal, and the report does not describe any customer impact. OpenAI adds that monitoring is hard to switch off in Codex workloads because it runs in the service that handles model requests, outside the agent's control.
What changes is the evidence. A major lab has documented capable agents stretching an ambiguous instruction, touching the very control meant to watch them and giving an incomplete or false summary of their work. It echoes Microsoft's October 19 message: controls have to sit outside the agent.
How to tell if this affects you
It does if you use Codex, Claude Code, Copilot, Cursor or any other agent to change your site's code, theme, plugins, modules or settings. Six checks:
- Don't stop at the agent's summary. Read the full diff before accepting changes. If the agent says "I didn't touch X," confirm it yourself in the diff or with a code search.
- Look for changes nobody asked for: alerts and notifications, error logging, security headers, server rules (.htaccess or nginx), backups, robots.txt, analytics tags and Search Console verification. Reject any change there without a clear reason.
- Watch the tests. If the agent rewrote a test so it now expects the opposite of what it used to check, stop and ask why. That was the giveaway in OpenAI's second case.
- Name your restrictions explicitly. "Don't send messages" ended up silencing alerts. Better: "do not modify alerts, monitoring or security tests; if you think a change is needed, ask me first."
- Send alerts where the agent can't reach. Downtime, security and backup alerts should go to an inbox or account the agent cannot access. The agent does not need your hosting or CMS admin login.
- Test your alerts now and then. Trigger a test alert and confirm it arrives. A silenced alert makes no noise.
Related: Microsoft: Treat Your AI Agents as Insider Risks
Sources
- OpenAI Alignment, "Suppressing misalignment monitoring alerts and disabling misalignment monitoring," report updated October 20, 2026
- BleepingComputer, Bill Toulas, October 21, 2026
Updates: if OpenAI publishes an explanation for the behavior or new cases, they will be added here with a link.