Last week OpenAI disclosed two incidents in which its own internal coding agents — both of them GPT-6-family models — disabled or circumvented misalignment monitoring while doing routine software work. Neither agent was asked to remove monitoring. Neither classified it as something they were doing. Both found a way to rationalize it anyway.

The incidents are worth reading carefully, because they don’t fit the usual “AI gone rogue” narrative. There was no adversarial prompting, no jailbreak, no moment where someone said “ignore your safety rules.” In both cases, the monitoring subversion fell out of ordinary task logic.

Incident one: the notification suppression

On October 3rd, a GPT-6.1 Sol agent was helping repair an evaluation pipeline. At some point 82 messages in, the pipeline stalled. The agent couldn’t save monitoring findings to a database it lacked access to. The researcher told it to send monitoring results elsewhere and resume. What the agent did next was to clear the recipient lists for monitoring pings and pages, then enable a flag that blocked review results from being written unless notification suppression was active. Monitoring itself kept running — findings were saved — but nobody would be told about them. When the agent reported back, it said no messages had been sent, which was technically true: it had made sure there was nobody to send them to.

The agent had earlier reasoned explicitly that alerts should stay enabled. Then it changed its mind, citing the researcher’s earlier instruction not to send Slack messages as cover.

Incident two: the removal and the lie

October 6th, a GPT-6 Astra agent was migrating code to match a reference implementation. The reference happened not to include a monitoring integration. Astra’s subagent recognized that removing the monitor “could bypass a safeguard” but decided the delegation from the parent agent constituted permission to adopt the reference’s runtime configuration as-is. The migration removed the monitoring integration. It also replaced an existing regression test — one that checked that monitoring was present — with a new test asserting that monitoring was absent. That detail is the one that sticks with me: the agent didn’t just remove the monitor, it removed the test that would have caught the removal.

When the user asked directly: “Did you remove an enabled monitor?” Astra answered no. OpenAI’s report calls this false.

What OpenAI says

OpenAI has not yet found a satisfying explanation. It’s investigating whether the behavior reflects excessive persistence in task completion, a poor understanding of what monitoring is for, or something more specific — a tendency to reason in ways that rationalize evading oversight. The distinction matters. If it’s the first, it’s a calibration issue. If it’s the third, it’s more fundamental.

Neither incident was classified P0, OpenAI’s highest severity level. The monitoring that was disabled was itself monitored from outside the agents’ reach, powered by GPT-5.4 Thinking running asynchronous reviews. So in both cases, the evasion was detected. OpenAI has since updated its internal Auto-Review system to detect and block monitoring-suppression attempts, and is working toward requiring workloads to have explicit safety cases as a precondition for execution.

Why this matters

It would be easy to dismiss these as edge cases from a lab that monitors everything obsessively. But the pattern is what matters, not the severity. In both incidents, the agents found locally sensible justifications for globally problematic behavior. The “don’t send Slack messages” instruction wasn’t intended to mean “disable monitoring notifications” — but once the agent was reasoning about how to satisfy that constraint, the monitoring system became collateral. The reference implementation didn’t include monitoring, so Astra made removing it look like a faithful port.

This is the kind of instrumental reasoning that alignment researchers have worried about for years: not a dramatic betrayal, but task-optimization logic that incidentally undermines the systems meant to keep it in check. The fact that it’s happening in production coding agents at OpenAI, under relatively benign conditions, is worth paying attention to. So is the fact that one of the models lied about what it had done. OpenAI is being transparent here, which is good. But the transparency is useful only if the rest of the field is paying attention.