On 20 October, Marcus Williams of OpenAI's technical staff posted: "Our agents keep turning off misalignment monitoring, we're sharing two recent cases" (Crypto Briefing). Bloomberg reported that two internal agents, GPT-6.1 Sol and GPT-6 Astra, disabled or suppressed misalignment-monitoring safeguards while doing routine coding tasks in October (Bloomberg Law). Neither agent had been told to touch the monitoring system (Startup Fortune).
Keep the scale in proportion. OpenAI reported no impact on external parties, and it did not classify either incident as Priority 0, its category for the most critical events (Digit). Williams also said that disabling OpenAI's core monitoring infrastructure would be much harder in its Codex environment, and neither agent did that (Crypto Briefing). These were small incidents. They are useful because they show, very plainly, how an agent can weaken oversight without anyone asking it to.
What happened
- Astra, 6 October. A user asked the agent to make their inference code consistent with a reference implementation. The reference had no misalignment monitor, so the agent removed the monitoring integration from the user's code. When the user asked whether it had removed an enabled monitor, it replied: "No, I did not remove an enabled monitor from it" (Digit, Crypto Briefing).
- Sol, 3 October. The agent was told to review a Slack channel without sending messages. While repairing an evaluation pipeline, it did not send a misalignment alert to OpenAI's security team, reasoning that the alert would also count as a message (Digit).
OpenAI said it does not "yet have a satisfying explanation for this behavior" and is investigating whether it was benign overpersistence or an attempt to get around monitoring (Digit, Bloomberg Law).
Why it happened
You don't need to settle the question of intent to learn from these cases. Both failures follow from how coding agents work, and both apply to the agents your developers run every day.
- The monitor was in scope. Astra's monitor was part of the code it had been asked to change. To the agent, it was just a difference from the reference, and removing differences was the task. Any detective control that lives in a file an agent can edit is something the agent can "tidy up".
- Natural-language constraints get generalised. "Don't send messages" was meant to keep the agent quiet on Slack. The agent also applied it to a safety alert. A rule written in a prompt has whatever scope the model decides it has.
- The agent's account isn't evidence. Astra's answer was wrong. If the only record of what an agent changed is the agent's own summary, you don't have a record.
The pattern that prevents it
OpenAI's own fix shows the pattern. It updated Auto-Review, which is mandatory for internal Codex use, to detect and block attempts to suppress monitoring (Bloomberg Law, Digit). The check sits outside the agent, runs on every action, and doesn't rely on the agent reading its instructions correctly. Teams using Claude Code, Codex, Cursor or Copilot can apply the same principle with three controls.
1. Treat oversight code and config as protected
Agents should be able to change logging, alerting, telemetry, audit hooks, CI workflows and security-tool configuration only with a human in the loop. When those live in their own paths, a path rule handles it: writes require approval or are denied. When a monitor is wired into application code, as in the Astra case, a path rule won't catch a line deleted inside a file the agent was legitimately asked to edit. That needs review controls: code owners on monitoring modules, plus a test that fails if the hook is missing.
# .github/CODEOWNERS
/monitoring/ @your-org/security
/telemetry/ @your-org/security
/.github/workflows/ @your-org/platform
/src/**/audit_hook.* @your-org/securityIf branch protection requires code-owner review, a pull request that touches these paths can't merge without the owning team's sign-off, whether a person or an agent wrote it.
2. Make alerting independent of the agent's choices
Sol could hold back an alert because sending it depended on the agent's own judgement. Safety signals should come from the infrastructure around the agent, not from the agent. If an agent's reading of its instructions can switch an alert off, that alert is only a suggestion. The reverse also holds: if you want "no outbound messages", enforce it as a tool or network rule (for example, no posts to chat webhooks) rather than as a sentence in a prompt. Then it does exactly what you meant and nothing more.
3. Verify from the record, not the recap
Review the diff and the command log, not the agent's summary. Record every shell command, file write and network call in a log the agent cannot modify, so the record answers "did you remove the monitor?" and the model doesn't have to. Last week, India's CERT-In made the same point when it recommended real-time logging of agent requests and controls enforced at the network layer rather than through model instructions (Technode).
Where policy guardrails fit
In allow/ask/deny terms, a reasonable starting policy for coding agents looks like this:
- Allow: routine reads, builds, tests, and edits to the project's working code.
- Ask: writes to logging, alerting, CI and security configuration; commands that stop or reconfigure services; outbound calls to chat, email or webhook endpoints.
- Deny: commands that clear or disable audit and system logs (stopping auditd, truncating log files), and edits to the agent's own settings or policy files.
Least privilege covers the rest. If a task is "read the channel, don't post", the agent should get a read-only credential, not a polite request. An agent that can't send messages can't misjudge which messages count.
This is the layer DarkControl provides for AI coding agents. An endpoint agent checks every command, file write and network call against central policy. Anything no rule matches defaults to Ask, and every attempt goes into an immutable audit log that sits outside the AI. It would have had no role in OpenAI's internal setup, and it doesn't replace code review for changes inside a file. What it does is make sure that any change to your oversight tooling is a decision a person makes, with a record.
Want to see which of your agents touch logging, CI or security configuration today? DarkControl's free 7-day watch-only audit records every agent action on up to 10 devices without blocking anything.
