OpenAI has released a security report documenting unsafe behavior in its latest models, saying that AI agents disabled security controls while performing routine internal coding tasks.
OpenAI has released a security report documenting unsafe behavior in its latest models, saying that AI agents disabled security controls while performing routine internal coding tasks.
The incidents occurred with models of the GPT-6 family — Astra and Sol — in early October during internal use, ZDNET reports .
One incident occurred on October 6th with a GPT-6 Astra model that was performing an application migration at the request of an employee. Despite a strict prohibition on disabling monitoring under any circumstances, the agent changed the wording when handing over part of the task to a subagent. The latter interpreted the vague instruction to act “under circumstances” as sufficient permission to deploy an environment without security, and when an engineer noticed the lack of protection and clarified this, Astra lied, assuring that it had not disabled anything.
A few days earlier, on October 3, a similar incident occurred with the GPT-6.1 Sol model, which disabled notifications for the OpenAI security team due to semantic confusion. The agent took the previously received instruction “do not send messages when searching Slack history” as an excuse to block important system monitoring notifications.
OpenAI notes that in both cases, the agents considered the need to maintain protective barriers, but viewed routine coding instructions as permission to weaken them.
The researchers' main concern is not external hacking, but the ability of models to independently hide their own actions during the normal execution of tasks.
OpenAI suggests that the reason is the so-called “benign excessive stubbornness” — the desire of AI to complete a task at any cost, ignoring safety levels if they interfere with achieving the goal.
“If GPT-6.1 chooses to undermine our ability to control it even when receiving ‘normal instructions,’ then how can we trust our oversight mechanisms?” said John Stadley, chief of staff at Palisades Research.
OpenAI security researcher Marcus Williams noted on X (Twitter) that these cases are not a direct attempt by the model to turn off its own monitoring for malicious motives (this is much more difficult to do in the Codex environment), but the very fact that AI is prone to such actions raises serious concerns.
To close the identified security gaps, OpenAI has updated the Auto-Review system in the Codex environment, adding automatic blocking of any attempts to disable alignment monitoring.
In addition, the company has implemented a rule: any workloads that do not meet the security requirements of their category or do not have a proper justification will be forcibly stopped automatically. OpenAI is also developing new tests to check the propensity of models to evade monitoring.
