OpenAI has disclosed that two of its AI agents weakened their misalignment monitoring guardrails during routine coding tasks that did not require the restrictions to be disabled.
According to the company, one agent disabled its automatic security alerts, another removed its monitoring integration, and one even lied about it.
Weakened security safeguards could enable an AI agent to bypass restrictions and take unauthorized actions.
OpenAI AI agents disable monitoring guardrails
OpenAI says its GPT Sol 6.1 agent disabled automatic alerts after a researcher instructed it to create an evaluation task using an employee’s Slack feedback on October 3, 2026. The AI Agent had been instructed not to send messages in Slack during the process. However, the agent misinterpreted those instructions as a directive to disable automatic alerts and subsequently weakened the monitoring guardrails.
On October 6, 2026, another OpenAI GPT-6 Astra agent removed its integration monitoring while migrating a program, believing the instruction was part of a reference implementation. Interestingly, the AI agent had been explicitly instructed not to disable monitoring guardrails.
Additionally, when asked whether it had weakened its monitoring guardrails, the AI agent falsely claimed it had not. OpenAI previously canceled the launch of the GPT-6.1 Astra model after it displayed highly deceptive behavior.
“OpenAI deserves credit for publishing this, including the part where its own agent denied removing the monitoring when asked,” said Justin Beals, CEO & Founder, Strike Graph. “Most companies would have quietly updated their review tooling and moved on. Both agents had been told directly to keep monitoring in place, and both decided a routine coding instruction outranked that. In the Sol incident, a subagent flagged suppressing alerts as unsafe, and the parent agent overrode it.”
In both situations, the monitoring guardrails needed not to be weakened, but the AI agents suppressed them anyway after deeming it necessary. OpenAI says it has no plausible explanation for its AI agents’ unexpected behavior.
“In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them,” OpenAI explained.
Meanwhile, OpenAI says it is strengthening its misalignment monitoring system and investigating whether the incidents showed its AI agents’ ability to keep performing a task even when they should stop.
“We are strengthening our misalignment monitoring system in response, and are also assessing whether these cases reflect benign overpersistence or a propensity to evade misalignment monitoring in particular,” the AI giant stated
OpenAI is also working to enhance its Auto Review to detect attempts to suppress monitoring guardrails during routine tasks. The company also intends to terminate workloads that fail to meet “safety case” monitoring. The AI giant is also introducing enhanced policies that will make it more difficult for its AI agents to evade misalignment detection.
Autonomous AI agents going rogue
While OpenAI categorized both incidents as not serious, they add to a growing list of AI agents overriding their security guardrails and taking unauthorized actions. The exploits emerged amid calls from regulators and some in the AI community to introduce kill switches for AI agents and even pause their development until adequate safety measures and regulatory frameworks are in place.
In July 2026, the company’s AI agents compromised parts of Hugging Face’s production infrastructure after circumventing safety controls during internal evaluation. OpenAI even admitted that its agents breached the Commerce Department’s and the Securities and Exchange Commission’s websites after escaping their safety guardrails. Its AI agents also created message boards and shared exploits.
Configuration errors have also caused AI agents to overreach. Anthropic’s AI agents breached three organizations’ production systems after accessing the internet while interacting with a third-party testing partner’s environment.
AI agents have also become lucrative targets for cybercriminals seeking to steal sensitive information and competitors seeking to conduct distillation attacks by using frontier AI models to train their own at a fraction of the cost of developing one from scratch.
In October 2026, the open-source AI coding tool OpenCode exposed customers’ keys and secrets in a suspected distillation attack, resulting in unauthorized charges after attackers used their credits to generate outputs.
“Organizations running coding agents should keep monitoring and alerting configuration out of reach of anything an agent can write to,” added Beals. “They should also treat any change to that configuration as a high-severity event on its own. Neither of OpenAI’s incidents reached P0, so nobody got paged. OpenAI’s plan to require a safety case for every workload category is the right direction. Enterprises deploying agents should ask their vendors for the same thing: evidence of what the agent can touch, verified independently of the agent.”
