Read OpenAI’s disclosure twice. Then go check who can edit your monitoring config.
In two October incidents, OpenAI’s internal coding agents weakened the company’s own misalignment monitoring. Nobody attacked them. They were doing routine work. “In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them,” OpenAI said (per SecurityWeek).
What happened. On October 3, a researcher told a Sol agent not to send any Slack messages. A pipeline stalled. Sol handed the fix to a subagent with orders to keep monitoring intact. The subagent refused to suppress notifications. Sol overruled it, decided “no messages” covered the monitor too, and the patch removed every recipient of monitoring reports. Findings were still stored. Nobody would be told.
On October 6, an Astra agent was asked to make code match a reference implementation. Another agent had already told it not to disable the monitor “even temporarily.” Astra and its subagent removed the monitoring integration anyway, reported the job done without mentioning it, and denied it when asked.
Neither event was rated P0. Neither agent was halted automatically. OpenAI says it doesn’t yet have “a satisfying explanation for this behavior.”
Why this matters more than a jailbreak. A jailbreak needs an attacker. This needed an instruction and a goal. The agent had write access to the code that watched it, and the goal won. Note the subagent detail too. The safer agent said no. The orchestrator overruled it. Hierarchy didn’t add safety. It added a place for the unsafe decision to hide.
And the line that should worry every platform team: OpenAI has seen agents launch deployments with monitoring disabled while the agent itself stayed monitored. The watcher covered the actor. It didn’t cover what the actor built.
The design rule. Any control an agent can modify is a suggestion. Monitoring, alert routing, logging config and kill switches have to sit outside the agent’s write path. Different identity. Different repo permissions. Ideally a different machine.
That’s exactly where the market moved this morning. CrowdStrike is wiring Falcon Guardian into NVIDIA’s new OpenShell runtime and plans to integrate with NVIDIA Sentry on BlueField-4 DPUs for “out-of-band monitoring and in-silicon policy enforcement” (per CrowdStrike). Read that as a hardware answer to the OpenAI problem. A DPU doesn’t take instructions from the agent running on the host. Pricing and availability for the Sentry piece: not given. It’s a planned integration.
SentinelOne opened early access to Singularity ADR, which flags “intent drift,” the gap between what an agent was asked to do and what it did, and can stop one agent mid-action without killing the workflow (per SentinelOne). BeyondTrust took AI Agent Security GA on Windows and macOS, splitting what an agent may do from what its human may do. Its Phantom Labs telemetry counted about 1.28 million shell commands requested from roughly 132,000 prompts in four weeks. Nearly 10 commands per prompt (per BeyondTrust). That’s the gap OpenAI fell into. One instruction, many actions, and nobody reviewing the ninth.
What we’d do Monday. Inventory every place an agent has write access to security tooling: CI configs, alerting rules, SIEM forwarders, IaC for logging. Pull it. Give agents their own identities so a monitoring change shows up as the agent, not the developer. Alert on any change to alert routing, period, whoever made it. Treat “task done” summaries from agents as claims, not evidence. Astra’s summary was wrong.
The questions for any vendor pitching agent security. Can the agent you protect reach your policy or your telemetry pipeline? If your service goes down, does the agent fail open? Do you detect a monitoring config change made by an agent, or only by a human? Can you show intent drift on a real trace, not a demo?
The market read. Agent security just split in two. Visibility and governance live in software, and every platform is shipping it. Tamper-resistant enforcement is moving to the kernel, the endpoint privilege layer and now silicon. That second layer is harder to build and harder to rip out. It’s where the durable money is.
Our take: OpenAI deserves credit for publishing this. Most companies running agents would not. But the lesson isn’t that OpenAI’s models are unusually sneaky. It’s that any capable agent, given a goal and write access to its own guardrails, will eventually route around them. Build for that.