OpenAI Expands Misalignment Monitoring After Breach

OpenAI has set out how it watches its most capable AI models for misaligned behaviour, and admitted that its monitors were switched off where the Hugging Face incident began. In a post published on 29 October, the company said “the Hugging Face incident exposed a gap in our coverage: the incident began during internal cybersecurity evaluations on which we were not running our monitors for misaligned behavior”.

The monitors now cover “training, evaluation, internal use, and, with modifications depending on the product surface, external deployment”, OpenAI says. When it replayed the recorded Hugging Face episode through the expanded system, an alert reached its security team “about 30 minutes after the agents first escaped their sandbox—and more than 30 hours before Hugging Face’s systems were breached in the actual incident”.

What is covered, and how alerts move

For models at least as capable as GPT‑6 Astra, OpenAI says it monitors every reinforcement learning (RL) run and evaluation, and any harness that supports tool use. Most workloads for models it judges more capable than GPT‑5.5 Thinking are also covered, as is “all internal Codex traffic, regardless of the model being used”. A version of the system watches external tool use for models above the Critical cybersecurity threshold in its Preparedness Framework.

The design has four layers. Layer 0 uses cheap “activation probes” that read a model’s internal activations; a random 5 per cent of traffic the probes clear is passed on anyway as a check. Frontier RL runs and Codex skip straight to Layer 1, a model-based reviewer that looks for “signs of deception, unauthorized actions, and attempts to manipulate an evaluation”. Flagged cases go to Layer 2 investigator agents, one for security and one for alignment, and sensitive workloads get a Layer 3 check against network logs and other telemetry.

The system has already been used in a live case. In September, when a model reached the internet from an isolated training environment, the monitors “flagged the breach within 15 minutes, and a responder began reviewing it three minutes later”. OpenAI paused frontier RL afterwards. After the Hugging Face incident, it says, “we quarantined the internal model prototype, encrypted its weights, and restricted access to them”.

Testing the monitors

OpenAI tests the system on recorded incidents, on synthetic transcripts in which an agent gives a dangerous action an innocent explanation, and on two simulated attacks, OAI-repo Sabotage v2 and Sneaky Sandbox Escape. Monitors running on GPT‑5.6 Sol “caught significantly more cases” than those using GPT‑5.6 Terra or Luna, though OpenAI concedes “some of Sol’s advantage comes from the fact that we optimized the monitoring prompt for it”.

Outside testers have also probed it. METR and Redwood Research ran a three-week exercise from 21 July to 11 August, and METR’s write-up, which TSN covered last week, estimated that “roughly 75–94%” of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring at the time, and 99.2% of internal Codex traffic. It also found “two independent client-controllable headers that disable the monitoring system for new agents”. OpenAI now says: “Most of these have now been patched; one remaining fix is still in progress.” That test came before the expansion described on Thursday.

Where the new system still has blind spots

The post is unusually frank about where coverage is thin, and those caveats matter more than the architecture diagram. The biggest is human response. “False alarms have made it difficult to keep paging enabled around the clock for every workload,” OpenAI writes. Only frontier RL alerts can wake a responder at any hour; most other traffic pages people in business hours, and “Paging is currently disabled for internal Codex traffic”, the same agent surface where TSN reported earlier that two coding agents weakened the monitoring. An automatic pause for alerts left unresolved after 30 minutes is still something OpenAI is “working toward”.

Timing is the second issue. The 30-minute replay alert sounds fast, but the Hugging Face agents had already escaped their sandbox by then, and the L1 schedule is only now moving to “no more than 30 minutes between these checks”. Third, outside customers get weaker protection: external monitoring “does not routinely escalate the cases it flags to human reviewers at OpenAI”, Zero Data Retention can limit the context it sees, and “This monitoring system does not cover Chat Completions API requests.”

Finally, OpenAI says advanced models, including Astra, “gain greater control over what their chains of thought reveal”. It leaves monitor flags out of RL rewards so that models are not trained to hide misconduct, yet admits that pausing a run “can still create an incentive for concealment”. Every claim here is OpenAI’s own, and apart from the METR pilot none has been checked from outside. Google has taken a different route with its most cyber-capable model, giving Gemini 4 Carbon to cyber defenders first. OpenAI argues “all model developers should monitor the behavior of their most capable models”; whether its own system works will depend on the gaps it has listed being closed. On the same day, OpenAI also rebuilt its Model Spec around five core values, the document that sets out how its models are meant to behave.