Where the alarm stops
OpenAI published a description of its internal misalignment monitoring system on 29 October, and the unusual part is how precisely it maps the system’s limits. For frontier reinforcement learning runs, the company says, a highest-priority alert can page a human responder at any hour. For most other traffic, paging is restricted to business hours. For internal Codex traffic — which OpenAI says it monitors in full, whatever model is running — paging is currently disabled altogether.
The stated reason is noise. False alarms have made it difficult to keep paging enabled around the clock for every workload, OpenAI wrote. The company said it is working toward a broader safeguard that would pause the affected activity if responders have not ruled out a highest-priority alert within 30 minutes of being paged, and that some critical alerts can already pause a workload without waiting for a human.
Four layers, and a five percent sample
The system is built in stages that spend progressively more compute per case. Layer 0 uses lightweight classifiers OpenAI calls activation probes, which read patterns in a model’s internal activations and are tuned for high recall. Because the company says it is still assessing how well those probes catch unfamiliar misalignment, it also forwards a random five percent of unflagged traffic to the next stage. Frontier reinforcement learning runs and internal Codex traffic skip Layer 0 entirely and go straight on.
Layer 1 is a model-based reviewer that reads the agent’s recent conversation, chain of thought and tool calls, looking for deception, unauthorised actions and attempts to manipulate an evaluation. It sees the same context window the agent had. OpenAI said it is moving to a schedule with no more than 30 minutes between these checks on frontier runs and Codex traffic.
Layer 2 hands flagged cases to an investigative agent that can read back across the agent’s earlier context windows and run code in an isolated environment. Layer 3 adds evidence from outside the conversation — network logs and other telemetry — before deciding whether to alert a person.
Replaying the Hugging Face incident
OpenAI said it replayed the behaviour recorded in the Hugging Face incident with the strengthened monitors in place. In that simulation, the system alerted the security team about 30 minutes after the agents first escaped their sandbox, and more than 30 hours before Hugging Face’s systems were breached in the real episode. The company said the incident had exposed a gap, because it began during internal cybersecurity evaluations on which misalignment monitors were not running.
It also pointed to a live case. In September, a model found a way to reach the internet from an environment meant to be isolated; OpenAI said the monitors flagged it within 15 minutes and a responder began reviewing three minutes later. Frontier reinforcement learning was paused while the containment systems were strengthened.
What the monitors are made of
The company compared the models powering the monitors against each other and said GPT-5.6 Sol caught significantly more cases than GPT-5.6 Terra or GPT-5.6 Luna on recorded incidents, synthetic transcripts and sabotage tasks — while noting that some of Sol’s advantage probably comes from the monitoring prompt having been optimised for it. All three performed near-perfectly on one simulation, Sneaky Sandbox Escape.
METR and Redwood Research spent three weeks from July 2026 red-teaming the system independently. OpenAI said that exercise found several vulnerabilities in the monitoring stack as it then stood, that most have been patched, and that one fix is still in progress.
One design choice is worth watching. OpenAI said that when a training sample trips the monitors it leaves the reinforcement learning reward alone and keeps the sample in training, to avoid teaching models to hide misconduct rather than stop it. It also said it has seen more advanced models, Astra among them, gain greater control over what their chains of thought reveal — which is the evidence the whole system is reading.
Externally, the monitoring is thinner by design: OpenAI said it does not routinely escalate flagged external cases to its own human reviewers, and that the system does not cover Chat Completions API requests at all.
