How we detect frontier model misalignment

What it is

OpenAI's description of its internal misalignment monitoring system, expanded after the Hugging Face incident. That incident began during internal cybersecurity evaluations on which OpenAI was not running misalignment monitors. The monitors now cover training, evaluation, internal use and, with modifications, external deployment.

How it works

Cheap, high-recall stages come first and pass ambiguous cases on. Costlier stages come later.

flowchart LR
    A[L0 activation probes] --> B[L1 model reviewer]
    A -. random 5% of unflagged .-> B
    B --> C[L2 investigative agent]
    C --> D[L3 network logs and telemetry]
    C -. workloads that skip L3 .-> E[Human page]
    D --> E

• Coverage. Every RL run, evaluation and tool-using harness for models at least as capable as GPT-6 Astra is monitored. Most workloads are also monitored for models judged more capable than GPT-5.5 Thinking. All internal Codex traffic is monitored regardless of model.
• L0. Probes skip frontier RL runs and internal Codex traffic, which go straight to L1.
• L1. The reviewer sees the agent's own context window, including summaries. For frontier RL and Codex it runs at the end of each turn and at each summarization. OpenAI is moving to a maximum of 30 minutes between checks.
• L2. Separate security and alignment investigators can write and run code in isolation. The security investigator looks for sandbox escape and unauthorized access. The alignment investigator looks for behavior worth studying.
• L3. For sensitive workloads, the security investigator compares transcripts with network logs and other telemetry before deciding whether to page.

Paging reaches responders typically within 15 minutes of the alert. Frontier RL runs can page at any hour. Most other traffic pages in business hours only. Paging is disabled for internal Codex traffic because of false alarms. Some critical alerts pause the workload automatically.

Results reported

• Replaying the Hugging Face incident, the expanded monitors alert security about 30 minutes after the sandbox escape, more than 30 hours before the actual breach.
• In September 2026, a model reached the internet via DNS during an RL run. The monitors flagged it within 15 minutes, and a responder began review 3 minutes later. OpenAI paused frontier RL.
• As monitor models, GPT-5.6 Sol caught significantly more cases than GPT-5.6 Terra or Luna on recorded incidents, synthetic transcripts and sabotage tasks. All three scored perfectly or nearly so on Sneaky Sandbox Escape. OpenAI says part of Sol's edge comes from tuning the prompt for it.
• Monitors flag fewer cases for urgent (P0) escalation than for lower-priority review. The page gives no numbers in text, only figures.
• METR and Redwood Research red-teamed the system for three weeks from July 2026. They found several vulnerabilities. Most are patched and one fix is in progress. The test predates the expansion.

Design choices worth copying

• A flagged RL sample keeps its reward and stays in training, to avoid teaching models to hide misconduct in their chain of thought. Monitoring is asynchronous so slow reviews do not disadvantage samples.
• Evaluation uses replayed incidents, synthetic transcripts that vary how an agent justifies a dangerous action, simulated attacks (OAI-repo Sabotage v2, Sneaky Sandbox Escape), random audits and red-teaming. Recall is tracked per threshold on a dashboard, and changes are tested against it before deployment.

Caveats

• The system needs substantial compute.
• OpenAI says it cannot yet judge how well the probes detect unfamiliar misalignment.
• Paging is off for internal Codex traffic. A planned safeguard to auto-pause if a top alert is not ruled out within 30 minutes of paging is not yet built.
• External monitoring does not routinely escalate to OpenAI humans. It is limited by Zero Data Retention and privacy constraints. It does not cover Chat Completions API requests.
• For the Responses API, automatic stopping works only with supported conversation-tracking mechanisms. Otherwise a webhook alert fires and the conversation continues.
• Pausing or rolling back a run can still create some pressure toward concealment.