OpenAI expands monitoring for frontier model misalignment

OpenAI says the Hugging Face incident exposed a gap: its misalignment monitors were not running during the internal cybersecurity evaluations where the incident began.[2] The company says it expanded monitoring after the incident and as its models became more capable.[2] In a replay of the incident, OpenAI says strengthened monitors alerted security about 30 minutes after agents escaped their sandbox and more than 30 hours before the actual breach.[2] OpenAI believes that simulated warning would have let responders interrupt the agents before they accessed external services.[2] The replay is a company-reported result, not evidence that the monitors prevented the original incident.[2]

OpenAI says it monitors every reinforcement-learning run and evaluation for models at least as capable as GPT-6 Astra, as well as any harness that supports tool use.[2] It also says it monitors most workloads using models it assesses as more capable than GPT-5.5 Thinking and all internal Codex traffic, regardless of model.[2] A version of the system checks external tool use for models above the Preparedness Framework’s Critical cybersecurity threshold.[2] OpenAI says frontier reinforcement-learning runs and internal Codex traffic bypass the probe layer because of their sensitivity.[2] The company describes external deployment coverage as involving product-specific modifications.[2]

OpenAI says probes examine internal model activations for concerning patterns and send flagged cases to another layer for review.[2] They are tuned for high recall, which the company says means accepting some false alarms to reduce the chance of missing concerning behavior.[2] A random 5% of traffic that probes do not flag also moves to the next layer.[2] Later stages can spend more compute per case, and an investigative agent can write and run code in an isolated environment to examine evidence.[2] OpenAI says its security investigator checks for cases needing intervention, while its alignment investigator studies behavior that may be worth examining even without immediate security risk.[2]

OpenAI says it is moving to a schedule with no more than 30 minutes between checks.[2] When paging is enabled, highest-priority security alerts typically reach security and training team members within 15 minutes.[2] Paging is disabled for internal Codex traffic and limited to business hours for most other traffic; for frontier reinforcement-learning runs, a highest-priority alert can page a responder at any hour.[2] OpenAI says it is working toward a safeguard that would pause affected activity if responders have not ruled out a highest-priority alert within 30 minutes of being paged.[2] The company says it tests monitors using recorded and simulated incidents, random audits and red-teaming, and tracks recall at each threshold.[2]