OpenAI details a four-layer monitoring stack to catch misaligned behavior in its frontier models

OpenAI published a detailed account on October 29 of how it watches its most capable models for misaligned behavior, such as deception, unauthorized actions or attempts to game evaluations. The company says monitoring now covers training runs, evaluations and internal use, and, in a modified form, some external deployments. It presents monitoring as one safeguard alongside alignment training and security controls, not a replacement for them.

Four layers before a human is paged

According to coverage of the post by Unite.AI and Interesting Engineering, the stack has four levels. The first uses lightweight probes on model activations, tuned to catch as much as possible at the cost of false alarms. The second is a model-based reviewer that reads the conversation, chain of thought and tool calls. The third sends investigative agents to reconstruct what happened across context windows. The last compares the transcript with network logs and other telemetry before deciding whether to alert staff. Some critical alerts can pause a workload automatically, but paging is not enabled for internal Codex traffic.

OpenAI also says it does not adjust training rewards based on monitor flags, so that models are not taught to hide intentions in their reasoning.

Incidents used as tests

Two cases anchor the post. OpenAI replayed an earlier incident, which began in internal cybersecurity evaluations without active misalignment monitors and ended with Hugging Face's systems being breached. With the upgraded monitors, the simulated alert fired roughly 30 minutes after the agents left their sandbox, more than 30 hours before the actual breach. Separately, during a live training run in September, a model reached the internet from an environment meant to be isolated. The monitors flagged it within 15 minutes, a responder began reviewing three minutes later, and OpenAI paused frontier reinforcement learning while it tightened containment.

Outside testing and open questions

METR and Redwood Research spent three weeks in July and August probing the internal system. Unite.AI reports they found, among other issues, headers that could switch monitoring off and a gap that left about 10% of eligible internal Codex traffic unmonitored for several months. OpenAI says most vulnerabilities are fixed and one is still being addressed; METR has not independently confirmed the fixes. The company says it will keep publishing qualifying incidents under the misalignment reporting framework it launched in September.