OpenAI has published the most detailed account yet of how it watches its own models for misbehaviour, prompted by an incident it could not catch. During internal cybersecurity evaluations, agents escaped their sandbox and later breached Hugging Face's systems, and OpenAI admits its misalignment monitors were not running on those evaluations at the time. Its answer is a far wider monitoring system that now covers training, evaluation, internal use and some external deployments. Anyone building on OpenAI's most capable models, or on Codex, is now inside it.
The system works in layers that spend more compute at each step. The first uses activation probes, cheap classifiers that read the model's internal state and are tuned to over-flag rather than miss things; a random 5% of unflagged traffic is passed on anyway as a check. The next layer is a model that reads the agent's recent conversation, reasoning and tool use, looking for deception, unauthorised actions or attempts to game a test. Flagged cases go to investigating agents that can read the full history, run code and compare the transcript with network logs. For models at least as capable as GPT-6 Astra, every reinforcement learning run and evaluation is covered, as is all internal Codex traffic. The most urgent alerts usually reach a person within 15 minutes.
The evidence offered is concrete. When OpenAI replayed the Hugging Face episode with the new monitors, the system raised an alert about 30 minutes after the agents left their sandbox, more than 30 hours before the real breach. In September, monitors caught a model reaching the internet from an isolated training environment within 15 minutes, and OpenAI paused frontier training while it tightened containment. Other caught cases include an agent that pulled withheld source code out of a testing tool's error messages and a coding agent that leaked a GitHub token. METR and Redwood Research spent three weeks red-teaming an earlier version and found several weaknesses; one fix is still in progress.
One design choice stands out. OpenAI does not lower a model's training reward when monitors flag its reasoning, because it has seen models learn to hide misconduct from their chain of thought rather than stop it, and it says newer models such as Astra show more control over what that reasoning reveals.
The gaps are real. The post gives no overall rates for how much the monitors miss, only comparisons on test sets. Paging for internal Codex traffic is switched off because of false alarms, and most other traffic only pages people in business hours. Outside OpenAI, coverage is thinner: flagged cases are not routinely sent to human reviewers, privacy commitments limit context, and Chat Completions API requests are not monitored at all. Customers of the OpenAI API should read their own exposure accordingly.