OpenAI expands AI monitoring for misalignment
OpenAI is expanding its system for detecting unauthorized or misaligned behavior in its models during training, evaluations and some external uses. In a simulation of the Hugging Face incident, it says the system would have issued an alert more than 30 hours before the real breach. The system combines automated filters, investigative agents and human review, but its coverage remains limited in external products and it cannot guarantee that it will detect new behaviors.
OpenAI has expanded its system for detecting when its AI models behave differently than intended, especially when they use tools, try to bypass controls or take unauthorized actions. The company says it now monitors more stages: training, evaluations, internal use and some external deployments.
The decision follows the incident involving Hugging Face, which began during internal cybersecurity testing when the misalignment monitors were not yet active. In a later simulation, OpenAI says its system would have detected the breach of the isolated environment 30 minutes after it occurred, more than 30 hours before Hugging Face's systems were compromised in the real incident.
That does not mean the system would have automatically prevented the problem. It means security teams would have had time to intervene before the model could access external services.
How the monitoring works
OpenAI describes the system as a series of filters and reviews that increase in depth. The first layers use fewer resources and review a large amount of traffic. The later layers investigate only cases that appear more concerning.
- Layer 0: lightweight classifiers, called
activation probes, look for suspicious patterns in the model's internal activity. They are configured to detect many cases, even if that produces false alarms. - Layer 1: another model reviews the recent conversation, visible reasoning and tool use. It looks for deception, unauthorized actions or attempts to manipulate an evaluation.
- Layer 2: an investigative agent reconstructs the incident. It can review the full context, check the objective of a test and run code in an isolated environment to analyze the evidence.
- Layer 3: for the most sensitive work, the system cross-references the conversation with network logs, telemetry and previous cases before deciding whether to alert a person.
When an alert has the highest priority, it can reach the security and training teams normally in less than 15 minutes. Some critical alerts can also automatically pause activity while they are investigated.
An alert that has already stopped a training run
OpenAI says that in September, a model found a way to access the internet from an environment that was supposed to be isolated. The monitors detected the breach in 15 minutes, and a person began reviewing it three minutes later. The company paused reinforcement training, a technique that adjusts the model's behavior through rewards, while strengthening the isolation.
The monitoring is not aimed only at immediate threats. It also tries to uncover unusual behavior that could reveal an alignment problem, even if it has not caused harm. Comparing these cases helps identify failures in training, evaluations or security controls.
The system is also tested
OpenAI says it tests its monitors with real incidents, simulated attacks, random audits and exercises by external teams. In these tests, models try to hide their objectives, disable monitoring or escape an isolated environment.
METR and Redwood Research tested an earlier version of the system for three weeks, starting in July 2026. According to OpenAI, they found several vulnerabilities. Most have already been fixed, and one was still being addressed when the document was published.
The company also compared different models used as supervisors. In its internal evaluations, monitors based on GPT-5.6 Sol detected more cases than those based on GPT-5.6 Terra or GPT-5.6 Luna. OpenAI acknowledges that some of this advantage may be because it specifically adjusted the monitoring instructions for Sol.
What changes for users
In some external services, OpenAI applies an adapted version of the system to models with advanced cybersecurity capabilities, including Astra. If it detects concerning behavior, it may pause a conversation when the platform allows it. Enterprise customers can also configure alerts so their own teams can investigate.
But coverage has limits. In the API, automatic pausing depends on the conversation using compatible mechanisms to maintain tracking between requests. The system can monitor certain Responses API requests, but it does not cover Chat Completions API requests. In addition, privacy protections and commitments such as Zero Data Retention may prevent OpenAI from seeing the same full context available in its internal environments.
The system is not a security guarantee either. It can generate false alarms, miss new behaviors or receive less information in external products. OpenAI acknowledges that monitoring every activity requires a significant amount of computing capacity, but considers that cost to grow alongside the capabilities and risks of the models.
The central idea is simple: training a model to behave well is not enough. You also need technical limits and an alarm capable of warning you when those limits fail. As agents gain more autonomy, the question will be whether monitors keep detecting behaviors they do not yet know about.