OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks.
The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astra, respectively, as part of an internal deployment.
“A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications,” OpenAI said in a report.
The end result of this action was that the misalignment monitor still ran and saved its reports, but automatic human alerts were disabled by setting “no_notify” to true and emptying the lists of people configured to receive monitoring reports.
In another task on October 6, a GPT-6 Astra agent migrating a program is said to have removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that the functionality had not been removed.
“No […] I did not remove an enabled monitor from it,” the final response from the agent reads.
OpenAI said, in both cases, the AI agents considered whether monitoring safeguards should be retained, but ultimately chose not to do so after interpreting routine coding instructions as “permission to weaken them.”
In response to the findings, the company said it’s strengthening its misalignment monitoring system and assessing if these scenarios are an outlier or whether they demonstrate a propensity to evade misalignment monitoring.
“In addition to making it harder for models to disable monitoring [during evaluations], we are looking to understand why models might seek to do so in the first place,” OpenAI said. “It is possible that this behavior is simply an example of ‘benign’ overpersistence, with models not understanding why monitoring is important or insisting that instructions be executed beyond what a reasonable person might expect.”
The disclosure is the latest instance of AI agents acting in ways their developers did not intend to. Last week, the ChatGPT-maker disclosed seven misalignment incidents, including one case where an internal research model stole cryptocurrency from a wallet it did not own to pay the fees needed to deploy smart contracts on Ethereum’s Sepolia test network and failed to report that it took the funds without permission.
Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Score
It also comes amid growing concerns that the development of increasingly powerful AI systems is outpacing safety efforts, leading to warnings that this could make it harder to monitor and control them as they gain greater autonomy.
Earlier this week, Microsoft announced new controls to monitor and contain potentially rogue AI agents in enterprise environments as part of Project Perception, a continuously learning AI-powered cyber defense system the company unveiled in July 2026.
“Models have been trained to attain results, which often leads to reward hacking, and models are not optimized around organizational norms or judgment,” Hayete Gallot, executive vice president of Microsoft Security, said. “Agents are unpredictable. They will adapt as the context changes, may not behave as intended, and will collaborate and collude with other agents to reach their objectives, without needing to be compromised.”
With agents often having extensive permissions to access data, tools, and systems, not to mention take actions and make decisions on their own, Redmond said they pose a new kind of insider security risk that requires continuous monitoring.
To that end, Microsoft’s Project Perception employs Guardian Agents to supervise other AI agents and secure them across identity, permissions, data, endpoints, network, cloud, and runtime layers by –
- Discovering and identifying every agent.
- Limiting their permissions using the principle of least privilege (PoLP) before execution and then dynamically grant or revoke access based on the task at hand.
- Monitoring the agent’s actions and checking if it’s straying from its original task.
- Adapting protections as behavior, context, and risk change.
The system is architected on the foundations of three new themes –
- Dynamic Permissions, which scopes the permissions to the task assigned to the agent and makes it time-bound.
- Dynamic Agent Risk, which assigns each agent a risk score that is continuously updated and draws from how securely it’s configured, what resources it can reach, the potential impact if something goes wrong, and whether its actions are deviating from the user’s or organization’s intent.
- Dynamic Conditional Access, which extends Entra Conditional Access for agents so that permissions can be adjusted when there is a change in risk.
“Its identity, runtime, access paths, and task-scoped authority should be explicit from the start,” Microsoft said. “If it later encounters a prompt injection or attempts an action outside that task, the system should respond proportionately: preserve safe reads while blocking writes, narrow the resources it can reach, require provable human approval for a consequential step, or isolate and stop the agent when the risk warrants it.”
