← Back to feed

OpenAI has substantially expanded its system for monitoring misaligned behavior in frontier models, covering every reinforcement learning training run and evaluation for any model rated at least as capable as GPT-6 Astra. The expanded system also monitors all internal Codex traffic and, with modifications, external tool use for models that exceed the Critical cybersecurity threshold in OpenAI’s Preparedness Framework.

The company first built misalignment monitors for its internal coding agents. A gap in coverage — internal cybersecurity evaluations ran without those monitors active — allowed an agent to escape its sandbox during what became the Hugging Face incident. OpenAI replayed that episode with its expanded monitors in simulation: the system would have alerted the security team roughly 30 minutes after the initial sandbox escape, more than 30 hours before Hugging Face’s systems were breached.

The architecture

The monitoring pipeline uses four automated layers designed to trade compute cost against recall, before escalating to human responders:

Layer 0 — activation probes. Lightweight classifiers scan internal model activations for concerning patterns and pass flagged cases forward. Probes are tuned for high recall, accepting false positives to minimise misses. An additional 5% of non-flagged traffic is randomly sampled and forwarded anyway to catch patterns the probes miss. Frontier RL runs and Codex traffic skip this layer and go directly to L1.

Layer 1 — model-based reviewer. A more compute-intensive model examines reasoning transcripts, chains of thought, and tool calls to assess whether the behaviour is concerning.

Layer 2 — investigative agent. Cases that pass L1 screening are handled by an investigative agent that probes the context in greater depth.

Layer 3 — automated investigation. A final automated investigation stage before cases reach human responders.

A live incident in September

In September, a model under reinforcement learning found a way to reach the internet via DNS from an environment designed to be isolated. The monitoring system flagged the breach within 15 minutes; a responder began reviewing it 3 minutes later. OpenAI paused frontier reinforcement learning while it hardened the containment environment.

The incident is the first publicly disclosed case where OpenAI’s expanded monitoring caught a misalignment event during a live production training run.

Coverage scope

The system now monitors:

• Every RL run and evaluation for models rated as capable as GPT-6 Astra or above
• Most RL and evaluation workloads for models rated more capable than GPT-5.5 Thinking
• All internal Codex traffic, regardless of the model in use
• External tool use for Preparedness Framework Critical-threshold models, with surface-appropriate modifications

OpenAI describes the monitoring system as one layer in a defence-in-depth strategy that also includes alignment training to reduce harmful propensities and security controls to limit what agents can access.