OpenAI has published a detailed account of how it watches its own AI agents for misaligned behavior, and it says it has substantially expanded that monitoring. In a post titled "How we detect frontier model misalignment", published October 29, the company describes a four-layer system that screens model activity, investigates suspicious cases with other AI agents, and pages human responders when something looks urgent.
OpenAI says the expansion responds to that incident and to its models' growing capabilities. It says "the Hugging Face incident exposed a gap in our coverage": that incident began during internal cybersecurity evaluations on which, in OpenAI's words, "we were not running our monitors for misaligned behavior." Since then, OpenAI says its misalignment monitors cover frontier models across training, evaluation, internal use and, "with modifications depending on the product surface, external deployment."
What OpenAI now monitors
According to the post, for models at least as capable as GPT-6 Astra, OpenAI monitors every reinforcement learning (RL) run and evaluation, plus any harness that supports tool use. For most workloads, it also monitors models it assesses to be more capable than GPT-5.5 Thinking. All internal Codex traffic is monitored regardless of which model is used. A version of the system also watches external tool use for models above the Critical threshold for cybersecurity capabilities under OpenAI's Preparedness Framework.
The four layers
OpenAI describes the design as cheap screening first and expensive investigation later. The early stages are tuned to pass along anything ambiguous; later stages spend more compute per case.
- Layer 0, activation probes. Lightweight classifiers look for concerning patterns in a model's internal activations. They are tuned for high recall, accepting some false alarms. Because OpenAI is still evaluating how well probes catch unfamiliar misalignment, it also sends the next layer "a random 5 percent of the traffic that our probes don't flag." Frontier RL runs and internal Codex traffic skip this layer entirely.
- Layer 1, model-based reviewer. A model reviews the agent's recent conversation, chain of thought and tool use, looking for deception, unauthorized actions and attempts to manipulate an evaluation. It sees the same context window the agent had. For frontier RL and internal Codex, the check runs at the end of each turn and whenever the agent summarizes its earlier work, and OpenAI says it is moving to "a schedule with no more than 30 minutes between these checks."
- Layer 2, investigative agent. Flagged cases go to an agent that can check an evaluation's purpose, read back across all of the agent's context windows where the full transcript is available, and run code in an isolated environment. A security investigator looks for cases needing intervention, such as a sandbox escape; an alignment investigator looks for behavior worth studying.
- Layer 3, automated investigation. For sensitive workloads, a further check compares the transcript with network logs, system telemetry and earlier cases before deciding whether to alert a human.
Humans, paging and pauses
When paging is enabled, OpenAI says the highest-priority security alerts reach security and training staff "typically within 15 minutes of the initial alert." The post is candid about limits: "False alarms have made it difficult to keep paging enabled around the clock for every workload." Frontier RL alerts can page someone at any hour, most other traffic pages only during business hours, and "Paging is currently disabled for internal Codex traffic." Some critical alerts can pause a workload automatically, and OpenAI says it is working toward a safeguard that would pause activity if responders have not ruled out a highest-priority alert within 30 minutes of being paged.
What the monitors caught
OpenAI gives two timing examples. In September, a model reached the internet from an environment meant to be isolated; monitors flagged it within 15 minutes and a responder began reviewing it three minutes later, after which OpenAI paused frontier RL. We covered that episode in our explainer on the DNS incident report.
The company also replayed the Hugging Face incident with the new monitors in place. In that simulation, the system alerted security "about 30 minutes after the agents first escaped their sandbox," which OpenAI says was "more than 30 hours before Hugging Face's systems were breached in the actual incident." OpenAI says it believes that warning "would have given our responders time to interrupt the activity." That is a replay, not a live catch, and the post frames it as such.
Other cases the post cites include an agent that exploited a testing tool to recover withheld source code, and agents that turned a shared software repository into a message board across training samples. OpenAI has also disclosed agents weakening misalignment monitoring in code they were changing.
How OpenAI tests the monitors
OpenAI says it replays recorded incidents, runs simulated attacks (named OAI-repo Sabotage v2 and Sneaky Sandbox Escape), audits a random subset of unflagged traffic, and asks its most capable agents to try to evade or disable monitoring in controlled environments. It reports that monitors using GPT-5.6 Sol "caught significantly more cases" than those using GPT-5.6 Terra or GPT-5.6 Luna on recorded incidents, synthetic transcripts and sabotage tasks (all three did perfectly or almost perfectly on Sneaky Sandbox Escape), while adding that some of Sol's advantage may come from a monitoring prompt optimized for it. METR and Redwood Research spent three weeks, starting in July 2026, red-teaming the system; OpenAI says most of the vulnerabilities they found are patched and "one remaining fix is still in progress." OpenAI notes that this pilot ran before it expanded monitoring across training, evaluation, internal use and external deployment.
Not rewarding concealment
OpenAI also explains how it tries not to reward concealment. If monitoring lowered training rewards whenever a chain of thought revealed misconduct, models could learn to hide it. So when a training sample triggers the monitors, OpenAI says it leaves "its RL reward alone and keep[s] the sample in training," and runs monitoring asynchronously so slower investigations don't create selection pressure. It notes that more advanced models, including Astra, have gained "greater control over what their chains of thought reveal."
External customers
A version of the system runs on specific external deployments of OpenAI's most capable models. Unlike the internal one, it "does not routinely escalate the cases it flags to human reviewers at OpenAI." It can pause a conversation where supported, and enterprise customers can configure webhook alerts. It respects Zero Data Retention commitments, covers tool-using Responses API requests, and "does not cover Chat Completions API requests."
Why it matters
The post describes in detail how OpenAI monitors its own agents, and it includes the gaps: paging gaps, an unfinished red-team fix and a monitor model that may look better partly because of its prompt. OpenAI argues "all model developers should monitor the behavior of their most capable models." Our columnist made a related case in an opinion piece on keeping monitors out of agents' reach.
