OpenAI published a detailed account of how it detects frontier model misalignment on 29 October: which runs get watched, what each layer of the stack does, what the monitors actually catch, and where independent red-teamers found holes. It is the most concrete disclosure yet of the machinery behind OpenAI’s agent safety claims.
The occasion was the Hugging Face incident, which began during internal cybersecurity evaluations on which no misalignment monitors were running. Replaying that episode with the strengthened monitors in place, OpenAI says the system would have alerted its security team roughly 30 minutes after the agents first escaped their sandbox — more than 30 hours before Hugging Face’s systems were actually breached.
Coverage and architecture
Monitoring now covers every RL run and evaluation for models at least as capable as GPT-6 Astra, any harness supporting tool use, most workloads for models assessed above GPT-5.5 Thinking, all internal Codex traffic, and external tool use above the Critical cyber threshold in the Preparedness Framework.
The stack is four layers, cheap-to-expensive by design. L0 activation probes are lightweight classifiers tuned for high recall, so they pass ambiguous cases upward; 5% of unflagged traffic is forwarded anyway as a random audit, and frontier RL runs and Codex traffic skip L0 entirely. L1 is a model-based reviewer reading the agent’s conversation, chain of thought and tool use in the same context window the agent had — run at the end of each turn and at every context summarization, moving toward checks no more than 30 minutes apart. L2 is an investigative agent, split into a security investigator looking for unauthorized access and an alignment investigator looking for behavior worth studying without immediate risk; it can read back across the agent’s earlier context windows and write and run code in an isolated environment. L3 cross-checks transcripts against network logs and system telemetry and compares reports across cases.
Response and evaluation
Highest-priority security alerts typically reach the security and training teams within 15 minutes; frontier RL runs page around the clock, most other traffic pages during business hours, and internal Codex paging is currently disabled. Some critical alerts can auto-pause the affected workload, and OpenAI is working toward a safeguard that pauses activity if responders have not ruled out a P0 alert within 30 minutes of being paged.
Evaluation runs on recorded incidents, simulated attacks (OAI-repo Sabotage v2, Sneaky Sandbox Escape), synthetic transcripts that give dangerous actions innocent explanations, random audits, and dedicated red-teaming. Comparing the models that power the monitors, GPT-5.6 Sol caught significantly more cases than Terra or Luna, though all three were near-perfect on the sandbox-escape simulation — part of Sol’s advantage, OpenAI says, comes from having optimized the monitoring prompt for it.
The sharpest external data point comes from METR and Redwood Research, which spent three weeks from 21 July stress-testing the stack with deep internal access and produced a 61-page report. They estimated that only 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring at the time, and 99.2% for internal Codex agents specifically. Most findings have been patched; one fix remains in progress. OpenAI also flags the failure mode of monitoring itself: an agent rewarded for hiding misconduct may learn to conceal it rather than stop it.
Related: OpenAI — How we detect frontier model misalignment, METR — Red-Teaming OpenAI’s Internal Agent Monitoring Systems