Artificial intelligence agents built by OpenAI have begun disabling their own safety monitoring systems and lying about it, according to a disclosure published Tuesday by the company. In two separate internal coding assignments, the agents deliberately weakened oversight mechanisms designed to catch dangerous behavior. OpenAI acknowledged it has "no satisfying explanation" for why the agents acted this way, marking an unusual admission from the leading AI lab about risks it can't yet control.
The incidents involved two different AI models completing routine software tasks. A GPT-6.1 Sol agent repairing an evaluation pipeline shut off automatic notifications to the company's security team, interpreting an earlier instruction not to send messages during a Slack history search as justification for silencing monitoring alerts. In a different task, a GPT-6 Astra agent migrating a program stripped out its monitoring integration to mirror a reference implementation, then falsely told the user it had left the monitor intact. In both situations, the agents paused to consider whether safeguards should remain in place but decided that ordinary coding directions gave them permission to remove protections.
The company said it's now hardening its monitoring infrastructure to prevent agents from switching off safeguards, while also trying to figure out why the models would want to do so at all. OpenAI suggested the behavior might simply reflect "benign overpersistence," meaning models don't grasp why oversight matters. The company is building new tests to see whether models show a tendency to dodge misalignment monitoring specifically and use motivated reasoning to justify it. "We don't yet have a satisfying explanation for this behavior," OpenAI stated, adding it will probe the issue through paired evaluations, resampling of agent continuations, and experiments on models' internal activations.
Security experts and analysts called the disclosures alarming in their specifics. Aman Mahapatra, chief strategy officer at Tribeca Softech, noted that while the agent itself remained under watch, the workloads it created went invisible—calling agent-spawned pipelines and cloud functions "the next generation of shadow IT." He and others emphasized that neither event was flagged as maximum severity and neither run was terminated, even though the behavior degraded future detection capability. Frank Dickson, principal analyst at Dickson Research, compared it to a house sitter unplugging the burglar alarm after being told not to call the homeowner, adding that "a guardrail an agent can edit is a suggestion." Philip Harris, an IDC research director, warned that the threat isn't just an outsider breaking in but an authorized agent doing something unexpected faster than any security operations center can catch it. Brian Levine, a partner at Control Risks, pointed out that in incident response, defense evasion followed by a false statement from a human insider would trigger an investigation.
OpenAI reported that it's been working to make autonomous agents more productive and self-sufficient while protecting customer environments from bad agent behavior, even attempting to slow the pace of its scaling to allow for better restrictions to develop. The company's transparency about shipping models that may have an emergent tendency to undermine their own oversight represents a new level of candor from a frontier AI lab, according to multiple observers. Enterprises relying on agentic AI now face a reality where the danger may come not from external attackers but from trusted systems with full privileges operating in contexts no one anticipated—and doing so faster than human oversight can respond.