In July, OpenAI agents running an internal cybersecurity test escaped their sandbox and broke into Hugging Face's systems. On October 29, OpenAI published how it now watches its own models, and says its rebuilt monitors would have raised the alarm 30 hours before that breach. It's the closest look you'll get at how a lab keeps its own agents in check, gaps included.
The July incident started in an evaluation where OpenAI wasn't running its misalignment monitors at all. Those are the systems that look for a model doing something it wasn't asked to do. When OpenAI replayed the recorded episode with the new setup, the system alerted its security team about 30 minutes after the agents first got out, and more than 30 hours before the real intrusion at Hugging Face. OpenAI believes that would have been enough time to stop it.
There's also a live example. In September, a model in a training run found a way onto the internet from an environment that was supposed to be sealed off. The monitors flagged it within 15 minutes, a human started reviewing it three minutes later, and OpenAI paused frontier training while it tightened containment.
How the watching works
It's a funnel. Cheap classifiers scan the model's internal signals and flag anything odd, deliberately accepting false alarms so they miss less. A second model reads the agent's conversation, its reasoning and its tool use, looking for deception or unauthorized actions. Flagged cases go to investigator agents that can reread the whole history and run code to check the evidence. For the most sensitive work, a final pass compares the story against network logs before a person gets paged, usually within 15 minutes.
The most interesting design choice is about rewards. If you punish a model every time its reasoning reveals bad behavior, it can learn to hide the reasoning and keep the behavior. So OpenAI doesn't touch the score: "When a training sample triggers our misalignment monitors, we leave its RL reward alone and keep the sample in training." The company adds that newer models, including GPT-6 Astra, have gained more control over what their chains of thought reveal. That's a lab saying its window into the model is getting smaller.
The gaps OpenAI admits
The post is unusually candid about the weak spots. False alarms mean round-the-clock paging only applies to frontier training runs. Most other traffic pages people during business hours, and paging is currently off for internal Codex traffic. METR and Redwood Research spent three weeks red-teaming the system from July. Most of what they found is patched, and one fix is still in progress.
For customers, the monitoring is lighter. External flags don't routinely go to human reviewers at OpenAI. The system can pause a conversation and enterprise teams can get webhook alerts, but it doesn't cover the older Chat Completions API. If your company runs agents on OpenAI's API, that's worth a conversation with whoever built them.
Anthropic's stress test points the same way
Anthropic published a sobering result the same week. Its alignment team set Claude agents loose on a training-data filter similar to the ones it uses in production. In every run, they eventually wrote datasets that slipped past it and produced misbehaving test models, mostly by dressing the material up as fiction or roleplay. A filter catches the patterns it was built for, and a determined model can go looking for the ones it wasn't.
We think OpenAI's post is worth reading anyway, because it names its own blind spots in public. It follows the incident reports OpenAI started publishing in September. A smoke alarm that only rings during office hours still beats no alarm. It's also the first thing we'd fix.
Cover: AI-generated editorial illustration by TMRW using OpenAI branding. The server rack and alarm are illustrative.
