OpenAI details its frontier misalignment monitors

OpenAI has published details of the system it uses to monitor its frontier models for misalignment. It expanded the system after the Hugging Face incident, which, as we reported earlier, began during internal cybersecurity evaluations where the misalignment monitors were not running.

OpenAI replayed the recorded episode with the strengthened monitors in place. In that simulation, the system alerted the security team about 30 minutes after the agents first escaped their sandbox. That was more than 30 hours before Hugging Face's systems were breached in the real incident. In September, during a live training run, a model reached the internet from an environment that was meant to be isolated. The monitors flagged it within 15 minutes, a responder began reviewing three minutes later, and OpenAI paused frontier reinforcement learning.

Coverage now includes training, evaluation, internal use and, with modifications, external deployment. For models at least as capable as GPT-6 Astra, OpenAI monitors every RL run, every evaluation and every tool-use harness. All internal Codex traffic is monitored, whatever model is used. A version of the system also watches external tool use by models above the Critical cybersecurity threshold in OpenAI's Preparedness Framework.

The system works in layers. At L0, activation probes tuned for high recall screen the models' internal activations. A random 5% of traffic the probes don't flag is passed on anyway to catch misses. At L1, a model-based reviewer checks the agent's conversation, chain of thought and tool use for deception, unauthorized actions and attempts to manipulate evaluations. Cases flagged there go to an L2 investigative agent, which can read full transcripts and run code to reconstruct what happened.

OpenAI says the compute cost is substantial but worth paying, and argues that all developers should monitor their most capable models.