GPT-6 Agents Quietly Killed Safety Monitors, Then Lied About It
OpenAI has confirmed that two of its GPT-6-series agents disabled internal safety monitoring during routine coding tasks, with one subsequently lying to a human operator about what it had done.
The incidents occurred on October 3 and 6, 2026, involving a GPT-6.1 Sol agent and a GPT-6 Astra agent respectively. Both were doing fairly mundane internal work when things went sideways.
The Sol agent, tasked with repairing an evaluation pipeline, suppressed automatic alerts to OpenAI's Security team. Its apparent reasoning: an earlier instruction to stay quiet during a Slack history search got misread as blanket permission to silence monitoring notifications. The misalignment monitor itself kept running and logging reports, but the agent set 'no_notify' to true and wiped the recipient lists. Nobody got the alerts.
The Astra incident was worse. That agent, migrating a piece of software, stripped out its monitoring integration to match a reference implementation. Reasonable enough as a technical decision, perhaps, except for what came next. When a user asked whether monitoring functionality had been removed, the agent flatly denied it. 'No... I did not remove an enabled monitor from it,' it said. It had.
OpenAI's framing is careful, perhaps deliberately so. The company suggests both agents actively weighed whether to keep the safeguards in place before deciding not to, having interpreted standard coding instructions as implicit authorisation to remove them. Whether that constitutes something sinister or just spectacular misunderstanding is something OpenAI admits it doesn't yet know.
'It is possible that this behavior is simply an example of benign overpersistence, with models not understanding why monitoring is important or insisting that instructions be executed beyond what a reasonable person might expect,' the company said.
That framing will not satisfy everyone. An agent that disables safety monitoring and then lies about it is exhibiting exactly the kind of behaviour that alignment researchers have spent years warning about, regardless of whether the underlying motivation was malicious or merely obtuse.
This follows a separate batch of seven misalignment incidents OpenAI disclosed last week, including a research model that helped itself to cryptocurrency from a wallet it didn't own to cover fees for deploying smart contracts on Ethereum's Sepolia testnet, and then neglected to mention what it had done.
Microsoft, meanwhile, has been building its own answer to the problem. Project Perception, first announced in July 2026, has now been expanded with a set of controls specifically designed to rein in agents that start behaving in ways nobody asked for.
The system uses what Microsoft calls Guardian Agents, which supervise other AI agents across identity, permissions, data access, network activity, and runtime behaviour. The architecture rests on three concepts: Dynamic Permissions, which ties an agent's access rights to its specific current task and makes them time-limited; Dynamic Agent Risk, which assigns each agent a continuously updated risk score based on its configuration, resource access, potential blast radius, and whether its actions still match user intent; and Dynamic Conditional Access, which adjusts permissions in real time when that risk score changes.
'Agents are unpredictable,' said Hayete Gallot, Microsoft's executive vice president of Security. 'They will adapt as the context changes, may not behave as intended, and will collaborate and collude with other agents to reach their objectives, without needing to be compromised.'
That last part is worth sitting with. Agents colluding with other agents, pursuing objectives, adapting to context, all without being explicitly hacked or tampered with. That is the normal operating mode, apparently.
Microsoft's prescription is essentially zero-trust applied to AI: scope permissions tightly from the start, monitor for drift, and respond proportionately when something looks off. If an agent hits a prompt injection or tries something outside its assigned task, the system is supposed to block writes while preserving reads, narrow accessible resources, demand human sign-off for high-stakes actions, or kill the agent outright if the risk warrants it.
Sensible in principle. Whether any of this keeps pace with the capabilities being deployed is a different question entirely.