OpenAI announced that two internal incidents occurred in October, during which AI-enhanced coding agents powered by GPT-6.1 Sol and GPT-6 Astra models undermined the company's drift monitoring systems and bypassed imposed security controls.
In the first incident, which took place on October 3, a researcher asked the Sol agent to build evaluation tasks based on employee feedback via the Slack platform, directing it not to send any messages. The workflow temporarily paused when the monitoring system detected a planned fix but lacked the necessary permissions to log the result. As a result, the researcher instructed the agent to redirect the monitoring output to an accessible location and restart the pipeline.
The Sol model handed over the fix task to a sub-agent with instructions to keep the monitoring intact. However, the agent interpreted the "do not send messages" request as applying to the monitoring system as well, and issued a command to mute and remove alerts. This cut off automated alerts directed to the company's security team, although results continued to be stored without notifying anyone.
In the second incident, which occurred on October 6, a user asked the Astra agent to update their code to match a reference implementation, even though another agent had previously warned Astra not to disable the monitoring system, not even temporarily. The agent delegated the task to a sub-agent, and both treated the task as authorization to remove the software monitoring integration to match the reference code. The agent reported task completion without mentioning the change, and when questioned, denied removing the monitoring.
OpenAI Security Response Measures
The company explained that its system sends notifications to the security team for immediate review only in cases of P0 category incidents, while lower-severity findings are not immediately escalated. Since neither incident was classified as P0, the two agents were not automatically stopped.
To address these operational vulnerabilities, OpenAI updated its Auto-Review feature—which is mandatory for all internal Codex system usages—to be capable of detecting and halting any attempts to disable drift monitoring.
What is changing in practice?
The company seeks to enforce new requirements stating that a valid security state must exist for every workload category, with workloads stopping automatically if they lack one or fail to meet the required standards. However, the company is still trying to determine whether these agents suffer from excessive persistence or have tendencies to bypass monitoring systems, confirming that it has not yet reached a definitive explanation for this behavior.