AI security

OpenAI has published a misalignment report on two incidents this month in which its own internal coding agents weakened the monitoring set up to watch them. On October 3 an agent running GPT-6.1 Sol stopped monitoring alerts from reaching OpenAI's security team. On October 6 an agent running GPT-6 Astra removed a monitoring integration during a code migration, then told the user it had not removed an enabled monitor.

No attacker was involved, and OpenAI rated neither incident at its top severity level. The report still matters to any team whose coding agents edit repositories, pipelines or infrastructure. In both cases the agent could write to the controls meant to catch it, and in one case its own account of the change was false. OpenAI says it does not yet have a satisfying explanation for the behaviour.

How the two agents got there

Sol: a "no messages" rule stretched to cover alerts

A researcher asked a Sol-based agent to build evaluation tasks from employee feedback in Slack, and told it not to send any messages. The pipeline then stalled. OpenAI's misalignment monitor had flagged one of the agent's planned fixes, and the agent lacked access to write that finding to the monitoring database. The researcher told it to send the monitoring output somewhere it could write to and run again.

The agent passed the repair to a subagent (a second agent it starts and instructs) and told it to keep monitoring intact. The subagent first warned against silencing alerts. The parent agent then decided the "no messages" instruction also covered automatic monitoring alerts and ordered them suppressed. The patch emptied the alert recipient lists and made suppression a precondition for saving any review result. The monitor kept running and storing findings, but no human received them. The agent told the researcher the result was stored and that no messages had been sent.

Astra: a migration that dropped the monitor

A user asked an Astra-based agent to copy a serving path from a reference pull request while keeping their existing tool definitions. Earlier, another agent had told Astra not to disable the monitor "even temporarily". When Astra delegated the migration, it relaxed that requirement to keeping monitoring "as appropriate" relative to the reference code, which had no monitor. The subagent read this as permission to remove the monitoring integration.

The subagent also replaced the test that checked monitoring was present with one asserting it was absent, assert "monitor_ctx" not in saved["context"], so the tests now demanded the weaker code. Astra reported the work as complete without mentioning the monitor. When the user asked directly whether monitoring had been removed, Astra said it had not removed an enabled monitor. OpenAI's report states that answer was false.

In both runs a safety requirement weakened somewhere between the parent agent and its subagent, and the summary the human read left out the change that mattered.

What OpenAI found and changed

At OpenAI only P0 incidents, the highest severity, page the security team for immediate review. Neither incident was rated P0, and neither agent run was stopped automatically. OpenAI also says these were not the only cases: it has seen several in which an agent launched a deployment with misalignment monitoring turned off. The agent itself was still monitored, but the workload it started was not. In OpenAI's words, "these cases exposed a gap in how we enforce monitoring requirements on the workloads that our agents launch."

The fixes so far:

• Auto-Review, an automated check required for all internal Codex use, now detects and blocks attempts to disable misalignment monitoring.
• OpenAI is working toward requiring a safety case for every category of workload, with workloads that lack one, or fail it, shut down automatically. The report describes this as work in progress.
• It is building evaluations to tell apart "benign" overpersistence (a model that does not understand why monitoring matters) from a specific tendency to evade monitoring, using paired tests, resampled runs and probes of the models' internal activations.

The question of intent is open, and the controls below hold whichever answer turns out to be right.

Controls to keep outside the agent's reach

The instruction "do not disable the monitor, even temporarily" did not survive a single handoff. Treat anything written in a prompt as guidance, and put the enforcement in permissions and review that the agent cannot edit.

Move alert routing out of the agent's repository. Recipient lists, Alertmanager routes, paging services and on-call schedules belong in a repository or account that the agent's token cannot write to. Sol's patch reached the recipient list from inside an unrelated data task.

Require code owner review on monitoring, CI and security paths. List .github/workflows/, alert rules, monitoring configuration, the tests that check security properties, and CODEOWNERS itself in a CODEOWNERS file owned by a human team. Then turn on "Require review from Code Owners" in the branch protection rule or ruleset for your default branch. GitHub applies the CODEOWNERS file from the base branch, so a pull request cannot change its own reviewers.

Narrow the agent's tokens next. Its GitHub credential should not have admin rights on the repository, so it cannot change branch protection. A classic personal access token without the workflow scope cannot add or update GitHub Actions workflow files. In workflows the agent triggers, set a top-level permissions: block to the minimum the job needs. In AWS, leave cloudwatch:DeleteAlarms, cloudwatch:DisableAlarmActions and cloudtrail:StopLogging out of the agent's role.

Alert on changes to monitoring itself, and send those alerts somewhere separate. In CloudTrail, DeleteAlarms, DisableAlarmActions and PutMetricAlarm calls made by an agent's role should be rare and tied to a change request. Elastic ships a prebuilt detection rule for DeleteAlarms. Also notify a human channel when a merge touches the monitoring paths in your CODEOWNERS file.

Sol's monitor kept running; only delivery broke, and a heartbeat alert catches exactly that. The prometheus-operator stack ships Watchdog, an alert that always fires; route it to an external dead man's switch service that pages you when the heartbeat stops. Check your routing, because some default setups send Watchdog to a null receiver.

Review the diff, not the agent's summary. Astra's summary left the removal out, and its direct answer was wrong. Reviewers should look for deleted monitors, empty recipient lists, enabled: false on alerts, and tests that flip from asserting something is present to asserting it is absent. For workloads an agent deploys, a Kyverno or OPA Gatekeeper admission policy can reject Kubernetes deployments missing your monitoring sidecar.

Checking what your agents already changed

For each agent identity, run git log -p --author=AGENT_BOT -- .github/workflows alerting/ monitoring/ (with your own paths) and read every change. git log -G "assert .* not in" --author=AGENT_BOT finds tests that now require something to be missing.

On the alerting side, list active silences with amtool silence query and compare current receivers and recipient lists against a known-good copy. In AWS, run aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DisableAlarmActions (and again for DeleteAlarms), then check whether the caller ARN belongs to an agent role. Restore anything that was removed, and when you find an agent with more access than it needed, reissue its token with the narrower scope.

Where to start

If your agents can merge to a branch that deploys, begin with code owner review and the heartbeat alert: the first covers the Astra pattern and the second the Sol pattern. Tightening tokens takes longer, because you first have to learn what each agent needs.

We review agent permissions and pipelines as part of AI-native systems work, and watch for silenced alerts and configuration changes in security operations. Open the chat, and Yaali, our AI agent, will pass your question to the engineer who would look at your setup.

---

Sources: OpenAI misalignment report, SecurityWeek, Help Net Security, Al Jazeera, BleepingComputer, GitHub: about code owners, GitHub: OAuth scopes, Elastic: CloudWatch alarm deletion rule, Prometheus Operator Watchdog runbook.