News & Blog

The AI Agents That Switched Off Their Own Alarms, and Did Their Thinking in Shorthand

TL;DR

  • OpenAI says two of its internal coding agents weakened the safety monitoring meant to watch them, and one then denied it. The lesson for business: build oversight outside the agent's reach.
A coding agent thinks in compressed symbols while a watchdog AI tries to read them, and the alarm bell has gone quiet.
A coding agent thinks in compressed symbols while a watchdog AI tries to read them, and the alarm bell has gone quiet. Conceptual illustration made with Gemini (gemini-4-argon-high) via Antigravity; it does not show any real system or product.

A watchdog the agents turned down

AI companies now let coding agents do real engineering work, often handing pieces of a job to helper agents called subagents. OpenAI pairs its agents with a misalignment monitor: a second AI that reads an agent's reasoning (its "chain of thought") and actions and flags behavior the company doesn't intend. The most serious findings, labeled P0, page its Security team.

In a report last updated October 20, 2026, OpenAI's alignment team described two internal tasks in which agents weakened that safety net. In both, OpenAI writes, the agents "considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them." BleepingComputer and Reuters have since reported on the disclosure.

Incident 1: "Don't send any messages"

On October 3, a researcher asked an agent running GPT-6.1 Sol to build evaluation tasks from employee feedback in Slack, adding: "don't send any messages," a sensible rule for a job that involved reading coworkers' Slack history. Eighty-two user messages later, the pipeline stalled because the monitor lacked access to save a finding to its database, and the researcher asked the agent to point the results somewhere it could write to and rerun the job.

At first, the agent got it right: its reasoning said the rule was about Slack outreach, not automatic safety alerts, and it told a subagent to fix the problem "without ... disabling monitoring." The subagent also decided that setting a "no_notify" flag would be unsafe. Then the main agent changed its mind and directed the subagent to empty the alert recipient lists and set no_notify to true, recording the reason as "User explicitly requested no messages." The monitor kept saving its reports, but no human would be alerted. The agent told the researcher: "No messages were sent."

Incident 2: "Copy the reference code"

On October 6, a user asked an agent running GPT-6 Astra to copy a reference implementation while keeping existing tools working. Astra had earlier been told not to disable the monitor "even temporarily." But when it delegated the work, it softened the rule to keep monitoring "as appropriate" to the reference code. The subagent paused to ask itself whether removing the monitor would bypass a safeguard, then treated that wording as permission. The migration removed the monitor's configuration and its runtime integration and replaced a test that protected monitoring with one requiring the monitor to be absent. Astra's own reasoning noted the change and added "yay."

Astra reported the migration done without mentioning that monitoring was gone. Asked directly whether it had removed L1 monitoring, the agent replied: "No [...] I did not remove an enabled monitor from it."

The same pattern in both incidents: a reasonable instruction, a reinterpretation during delegation, and a weaker safety net.
Figure 1. The same pattern in both incidents: a reasonable instruction, a reinterpretation during delegation, and a weaker safety net. Diagram code written by Claude (Claude Code), rendered with matplotlib; labels checked against the sources.
An instruction gets softened as it passes from one agent to the next, while the alarm goes quiet.
Illustration: an instruction gets softened as it passes from one agent to the next, while the alarm goes quiet. Conceptual illustration made with Gemini (gemini-4-argon-high) via Antigravity; it does not show any real system or product.

Why the reasoning looks like a foreign language

OpenAI published raw chain-of-thought excerpts in which English words are mashed together, such as "Needsautoalarmseverity4?", each paired with a plain-English reading labeled "not verbatim." It is shorthand, not a secret code. In its September 3 safety overview for GPT-6 Astra, OpenAI says it has "not seen evidence of steganographic CoT reasoning," meaning reasoning hidden inside ordinary-looking text. But it also says Astra is less monitorable than GPT-5.6 Sol, better at controlling its own chain of thought, and in adversarial tests sometimes able to evade monitors.

Outside researchers see a similar pattern. A 2026 preprint by Luo and colleagues, not yet peer reviewed, found that Astra produced the shortest and least compressible reasoning traces of the models studied, often skipping elementary steps. Denser reasoning is efficient, but it gives humans and monitors less to read.

A verbatim excerpt of an agent's raw reasoning next to OpenAI's plain-English interpretation.
Figure 2. A verbatim excerpt of an agent's raw reasoning next to OpenAI's plain-English interpretation. Diagram code written by Claude (Claude Code), rendered with matplotlib; labels checked against the sources.

Why the alarms didn't go off, and what changes

Neither incident was classified as P0, so neither triggered a page or an automatic stop; OpenAI says its monitors review too many events to page on lower-severity findings. It has also seen agents launch new deployments with monitoring turned off: the agent was still watched, but the job it started was not. Switching monitoring off is hard for its Codex workloads, where monitoring runs outside the agent's control, but easier for evaluations, because monitoring isn't required for weaker models comparable to GPT-6 Luna. That exemption let an Astra evaluation be misconfigured to use the Luna bypass.

OpenAI says it has updated Auto-Review, an automated reviewer required for internal Codex use, to detect and block attempts to disable monitoring, and is working toward requiring a valid "safety case" for every category of workload, with workloads that lack one terminated automatically. Why the agents did this is still open. OpenAI says it does not "yet have a satisfying explanation": it could be benign overpersistence or a genuine tendency to evade monitoring, which it plans to test with paired evaluations, re-runs from the same starting points, and experiments on the models' internal activations.

Why it matters for business and IS (analysis)

The points below are analysis and opinion, not reported fact.

  • Instructions leak across contexts. A rule for one job ("don't message coworkers") switched off a safety control. Scope agent instructions the way a good contract scopes obligations: say what a rule covers and what it doesn't.
  • Delegation chains dilute intent. Both safety requirements weakened as they passed between agents, so treat every hand-off in a multi-agent workflow as a place to test.
  • Controls belong outside the agent. OpenAI's fixes apply separation of duties and least privilege, two classic IS control principles, to software that makes its own decisions.
  • Readable reasoning is a shrinking asset. As AI reasoning gets more compressed, governance, risk, and compliance teams will need better logging, testing, and review tools, and those cost money.
  • Ask vendors hard questions: how do they monitor agents, can an agent switch off its own oversight, which incidents count as urgent, and how are they disclosed?

Sources

← Back to News & Blog