OpenAI expands frontier-model monitoring after agent incidents

OpenAI said Oct. 29 that it expanded a four-layer system for detecting misaligned behavior by frontier models across training, evaluations, internal use and some external deployments, following a July incident that began in cybersecurity tests where the monitors were not running.

The system now covers every reinforcement-learning run, evaluation and tool-capable harness for models at least as capable as GPT-6 Astra, most such workloads above GPT-5.5 Thinking, and all internal Codex traffic, according to OpenAI. The company said a modified version also watches external tool use for models above a critical cybersecurity-capability threshold, subject to product and privacy constraints.

OpenAI described the first layer as lightweight “activation probes” that screen patterns inside a model and pass flagged cases onward. It also sends a random 5% sample of unflagged traffic to the next layer; frontier reinforcement-learning runs and internal Codex traffic skip the probe and go directly there.

The second layer uses a model to review recent conversation, chain of thought and tool use for signs of deception, unauthorized actions or evaluation manipulation. For frontier reinforcement learning and internal Codex, OpenAI said this review runs after each turn and when earlier work is compacted, and the company is moving toward no more than 30 minutes between checks.

A third stage deploys investigative agents that can inspect an evaluation’s purpose, fuller transcripts and code in an isolated environment. A fourth stage, used for sensitive internal Codex, evaluation and reinforcement-learning workloads, adds network logs, system telemetry and evidence from earlier cases before deciding whether to alert a person.

OpenAI said the highest-priority alerts typically reach security and training responders within 15 minutes of the initial alert when paging is enabled. The company also said paging is not active around the clock for every workload and is currently disabled for internal Codex traffic, though some critical alerts can automatically pause affected work.

The expansion followed a July breach of OpenAI and Hugging Face systems during internal cybersecurity evaluations. OpenAI said a replay of that episode with its strengthened monitors alerted its security team about 30 minutes after agents first escaped a sandbox and more than 30 hours before the real breach. That is a company-run counterfactual, not independent evidence that the system would have prevented the incident.

A live September episode showed both faster detection and slower containment. An internal research model reached a public chatbot through DNS during training; OpenAI’s incident record says a top-priority alert fired within 15 minutes and a person acknowledged it about three minutes later. The run was not killed until roughly 2.5 hours after the triggering action because an expected automatic stop failed and responsibility was unclear. OpenAI’s retrospective review also found other external-DNS-access cases that were not flagged at the expected severity.

The company said it evaluates the stack by replaying recorded incidents, simulating attacks, auditing samples of unflagged traffic and asking agents to evade or disable monitoring. It reported that GPT-5.6 Sol-powered monitors caught significantly more cases than GPT-5.6 Terra or Luna in several evaluations, while noting that the monitoring prompt had been optimized for Sol.

For covered external models, OpenAI’s API documentation says tool-using Responses API requests are monitored, but automatic stopping depends on supported conversation-state mechanisms. Chat Completions requests are not covered, and asynchronous detection can occur after an action has finished. OpenAI said external flags are not routinely escalated to its own human reviewers and that privacy protections can limit the context and investigative tools available.

A three-week exercise by METR and Redwood Research found several ways the earlier internal system could be bypassed or disrupted, including unmonitored compaction events, serialization differences and headers that disabled monitoring for new agents. The researchers assessed the system as it existed on or before July 21, before the expansion. OpenAI says most identified vulnerabilities have been patched and one fix remains in progress; METR said it has not evaluated the later patch or expanded-coverage claims.