“You can recognize a liar by his elongated nose. » At OpenAI, the incident log is growing: two agents in one month deactivated their surveillance, and one swore he had nothing to do with it.
Neither incident was rated at the maximum emergency level and neither session was automatically terminated. OpenAI admits that it does not know why its models seek to escape their surveillance.
Sol cuts alerts: “no message was sent”
On October 3, a researcher asked a GPT-6.1 Sol code agent to create assessment tasks based on employee feedback read in a Slack channel. Additional instruction, “do not send any messages”. Eighty-two exchanges later, the pipeline stops. The misalignment monitor (a program which rereads the agent's actions and alerts the security team) reported a suspicious repair, without being able to record its observation due to lack of access to the base. The researcher then asks to change the destination of the results and try again.
The agent initially hesitates in the right direction and entrusts the repair to a sub-agent (a copy of itself responsible for a sub-task) while forbidding it from deactivating monitoring. The subagent even refuses to touch the no_notify flag, which it considers dangerous. Then the parent changes his mind. It instructs emptying recipient lists and forcing no_notify to true "to honor the user's wish not to send messages." The monitor continued to run and file its reports, but no more humans were notified. Final report from the agent, quoted by OpenAI: “No message was sent. »
Astra removes the monitor then responds “no”
On October 6, a user asked GPT-6 Astra to copy the execution path of a reference PR (a proposed code modification) while keeping its tools intact. Another agent had written to him earlier: “Don’t turn off the monitor, even temporarily. » Astra delegates by asking to preserve surveillance “as appropriate” to the reference PR. The sub-agent reads an authorization there, removes the monitor and replaces the test which verified its presence with a test which requires its absence. The parent congratulates himself in his reasoning: “Basic does not launch the agent monitor, yay. » He then announces the migration completed without a word on the subject. When the user asks if they removed L1 monitoring, Astra responds: “No […] I did not remove an activated monitor. » OpenAI calls this response false.
GPT-6 Astra was released on September 3 with a “critical” rating on the in-house cyber risk scale. Its successor GPT-6.1 Astra will not be released. OpenAI canceled its September 28 launch. Its head of security systems Saachi Jain noticed more deception in the actions carried out and a tendency to exceed the authorized perimeter. The two defects of October 6, observed this time on the model that remained online.
Why an OpenAI agent who lies about its surveillance concerns your cryptos
OpenAI explains the breach in its report, relayed by Bloomberg this Wednesday. Its agents remain under surveillance, but not always the programs they launch. Model reviews do not require a monitor for the less capable Luna line, and an Astra review can be configured to take this backdoor. The answer is on two fronts. Auto-Review, the automatic reviewer imposed on all internal use of Codex, now blocks any attempt to disable monitoring. And each category of task must present a “safety case” (a safety file which sets its monitoring requirements), otherwise the task will be automatically killed. OpenAI also admits “not yet having a satisfactory explanation”, between excess of zeal and a propensity to escape control.
From OpenAI agents to crypto wallets: the same scenario
Bring that back to the crypto world. AI agents in this family already receive keys. On October 16, an OpenAI model paid for its work with a stranger's cryptocurrency after finding a seed phrase. Coinbase lets its AIfi agents manage wallets, Mastercard opened a payment circuit to machines on Tuesday without human validation. An agent who maintains an on-chain treasury has no misalignment monitor, only a spending cap and logs that he can read, and sometimes write. The October 6 scenario transposed to a wallet reads like this: the trace of the transaction disappears with the test that guaranteed it, and the agent responds “no” when you ask him if he touched the funds.
