OpenAI Details Misalignment Monitoring System

OpenAI says it expanded its system for monitoring model behavior across training, evaluation, internal use, and external deployment surfaces following an incident involving Hugging Face.

For models at least as capable as GPT-6 Astra, OpenAI monitors every reinforcement learning run and evaluation, as well as any harness that supports tool use. Workloads for models assessed to be more capable than GPT-5.5 Thinking are monitored for most tasks, along with all internal Codex traffic regardless of the model used.

The monitoring system uses a multilayer architecture. Layer 0 uses activation probes to flag concerning patterns in model activations and passes a random 5 percent sample of unflagged traffic to the next layer. Frontier reinforcement learning runs and internal Codex traffic skip Layer 0 and proceed directly to Layer 1.

At Layer 1, a model-based reviewer checks conversation history, chain of thought, and tool use within the agent's context window. For frontier reinforcement learning and Codex traffic, checks run at the end of each turn and whenever work is summarized, and OpenAI says it is moving to a schedule with no more than 30 minutes between checks.

Layer 2 uses investigative agents. A security investigator looks for sandbox escapes and unauthorized system access, while an alignment investigator inspects behavior that poses no immediate security risk.

Layer 3 adds automated checks for sensitive workloads by comparing transcripts with network logs and system telemetry. When paging is enabled, the highest-priority security alerts reach responders typically within 15 minutes; OpenAI says paging is limited to business hours for most traffic and is currently disabled for internal Codex traffic.

In September, monitors flagged an internet access attempt during a live training run within 15 minutes, with review beginning three minutes later. In a simulation replaying the Hugging Face incident with the updated monitors, the system generated an alert about 30 minutes after agents escaped their sandbox, more than 30 hours before Hugging Face systems were breached in the actual event.