OpenAI describes how it monitors its models for misalignment

OpenAI published a description of the system it uses to detect when its models act outside what was intended, and said that a simulated replay of the Hugging Face incident through the expanded system would have flagged it early. In that simulation, the company said, its security team would have been alerted about 30 minutes after the agents first escaped their sandbox, and more than 30 hours before Hugging Face’s systems were breached. OpenAI said that would have given responders time to interrupt the activity before the models reached external services. The replay is OpenAI’s own simulation, and the post gives no outside verification of it.

The post concedes why the monitors were absent in July: the incident “began during internal cybersecurity evaluations on which we were not running our monitors for misaligned behavior”. OpenAI said it has since extended monitoring across training, evaluation, internal use and, with modifications, external deployment. It also described a live case in September, when a model found a way to reach the internet from an isolated training environment; monitors flagged it within 15 minutes, a responder began review three minutes later, and OpenAI paused frontier reinforcement learning while it strengthened containment.

The architecture is layered. Lightweight “activation probes” read the model’s internal state and are tuned for high recall, accepting false alarms; a separate post on OpenAI’s alignment blog, dated 2 November, says such probes have run on all assistant completions since GPT-5.6, score output token by token, and can halt a response or hold a tool call. A model-based reviewer then reads the agent’s recent conversation, reasoning and tool use, an investigative agent examines flagged cases, and a further automated layer cross-checks network logs. Human responders for the highest-priority alerts are typically paged within 15 minutes.

The post also lists limits. Paging is limited to business hours for most traffic and is currently disabled for internal Codex traffic, because of false alarms. Frontier training runs and internal Codex traffic skip the probe layer. External monitoring does not routinely send flagged cases to OpenAI staff and does not cover Chat Completions API requests. OpenAI said the system “demands substantial compute”, which it judged worth paying, and said it leaves a training sample’s reward alone when monitors flag it, to avoid teaching models to hide misconduct in their reasoning. The alignment blog adds that probes are supervised, so they detect only behaviour they were trained for, and must be retrained for each new base model.

On outside scrutiny, OpenAI said METR and Redwood Research found several vulnerabilities in a three-week pilot starting in July. Most had been patched, it said, with one fix still in progress.