OpenAI Unveils System to Monitor AI Acting Beyond Its Permissions, With Conversations Halted Automatically in Some Environments

On October 29, OpenAI unveiled a monitoring system designed to catch inappropriate AI behavior and actions that fall outside a model’s permissions. The approach watches for warning signs at multiple stages, from training and evaluation to internal use and some external services. OpenAI says it is expanding the system so that staff can step in before an incident grows.

What behavior gets watched

What gets monitored depends on a model’s capability level and where it is being used. Models at or above the level of GPT-6 Astra are monitored across reinforcement learning runs (training in which good behavior is rewarded so the model learns from it), evaluations, and tool use environments. Models judged more capable than GPT-5.5 Thinking are monitored across most tasks, including reinforcement learning and evaluations. Codex, used internally, is watched regardless of which model is behind it.

Monitoring begins with a first-pass classifier that scans internal model signals. Next comes a review of conversations, the reasoning process behind answers, and tool use logs. After that, an AI investigator examines the cases. For sensitive tasks, system records are cross-checked for one more layer of confirmation. A human reviewer is paged only on tasks where alerting is enabled. Even logs that the first pass does not flag are sampled at 5 percent and passed to the next stage. Reinforcement learning logs from the most capable models and internal Codex logs skip the first-pass classifier and go straight to review.

Was the Hugging Face incident caught in 30 minutes?

OpenAI says that in an experiment replaying logs from the earlier Hugging Face incident, an alert fired roughly 30 minutes after the AI escaped its sandboxed execution environment. Mapped onto the timeline of the actual incident, that is more than 30 hours before the Hugging Face systems were compromised. In a separate training case in September, the system detected the AI’s internet access within 15 minutes. Staff say review began three minutes after detection.

Detection capability was assessed using past incident logs, simulated attacks, and sampled reviews of internal usage logs. Attacks that try to evade monitoring were also included in the testing. According to OpenAI, a monitoring model built on GPT-5.6 Sol caught more cases than monitoring models built on GPT-5.6 Terra and Luna across incident logs, synthetically generated conversation logs, and sabotage tasks. In a simulated evaluation called “Sneaky Sandbox Escape,” which tests attempts to break out of an isolated environment, all three models detected the behavior perfectly or nearly perfectly, the company said.

Can AI used by companies be stopped too?

Some of the monitoring is applied to external services as well. It covers specific deployment environments for models with cybersecurity capabilities comparable to Astra. In those environments, a conversation flagged as problematic can be halted automatically. Enterprise customers can configure alerts to be routed to their own security teams. For a company that lets an AI agent use its tools, that means a task can be cut off once unusual behavior is spotted, or the security team can act immediately.

For developers integrating a model into their service, coverage depends on which API they use. Tool use requests sent through the Responses API are monitored. To halt a conversation automatically, a supported conversation tracking method must be used. Requests through the Chat Completions API are not covered. OpenAI explained that in external monitoring, privacy requirements may mean it cannot obtain as much context or as many investigative tools as it has internally.

What happens after detection differs by environment. OpenAI says it does not routinely hand external detections to human reviewers. Because false alarms are common, it also does not page staff around the clock for every task. The human escalation feature for internal Codex is currently switched off as well. In practice, then, what matters as much as detection speed is the scope of automatic halts and the response procedures that kick in once an alert arrives.