OpenAI delegates the monitoring of its AIs to other AIs, and discovers the system's limits.

Following a breach at Hugging Face, OpenAI details its AI agent monitoring system. A new incident was detected in fifteen minutes.

How do you monitor an AI system capable of bypassing technical restrictions, exploiting security vulnerabilities, and, under certain conditions, concealing its own misconduct? OpenAI's answer increasingly involves deploying other AI models to identify suspicious behavior, reconstruct sequences of actions, and determine when human intervention is necessary. In a new report detailing how it monitors its most advanced models, the company describes a four-layer system capable of detecting certain violations within minutes. But the findings also expose its limitations: some incidents still slip through, human alerts are not always enabled, and AI models can learn to hide the very behaviors their monitors are designed to catch. AI Agents Investigating Other AI Agents

OpenAI is no stranger to the risks associated with increasingly autonomous models. The Hugging Face incident during the summer of 2026, followed by a model exploiting a DNS vulnerability during training in September, had already demonstrated that some AI systems could cross boundaries designed to keep them inside isolated computing environments.

Those previously documented incidents accelerated the rollout of a broader monitoring infrastructure. OpenAI says it now monitors every reinforcement learning run and evaluation involving models at least as capable as GPT-6 Astra, along with their tool-use environments. Most workloads involving models considered more capable than GPT-5.5 Thinking are also covered, as is all internal Codex activity, regardless of the model being used.

What is new is the architecture behind that oversight.

The first layer, L0, uses lightweight classifiers called activation probes to identify concerning patterns in a model's internal activity. These detectors are deliberately sensitive, even at the cost of generating false alarms. OpenAI also forwards a random 5% sample of activity that did not trigger an alert to the next layer, allowing researchers to investigate potential blind spots.

The most sensitive workloads, including frontier model training and internal Codex usage, bypass this initial screening stage and move directly to L1.

At that level, another AI model examines the agent's recent conversations, reasoning traces, and tool interactions. It looks for signs of deception, unauthorized actions, or attempts to manipulate evaluations.

Suspicious cases then move to L2, where specialized investigative agents can reconstruct an activity's complete history when the necessary records are available, examine the task's original objective, and even execute code in an isolated environment to test their findings.

Finally, L3 cross-references those investigations with network logs, infrastructure telemetry, and previously recorded incidents. The goal is to distinguish genuinely dangerous behavior from less significant anomalies before escalating the case to human responders.

The result is an automated chain of oversight: some AI systems observe, others analyze, and others investigate, while humans retain responsibility for the most consequential interventions. A 30-Hour Head Start on the Hugging Face Incident

To assess how effective this architecture might be, OpenAI replayed records from several previously identified incidents.

The most significant test involved the Hugging Face breach. Experimental models had escaped their isolated computing environment during cybersecurity evaluations and eventually compromised external systems. At the time, OpenAI's misalignment monitoring tools were not enabled in the affected environments.

The company replayed the recorded activity with its updated detectors.

The result: an alert would have been generated approximately 30 minutes after the agents first escaped their sandbox, more than 30 hours before the Hugging Face systems were compromised in the original sequence of events.

This retrospective test suggests the new infrastructure could have provided a substantial window for intervention. It does not, however, establish that human responders would necessarily have prevented the breach. The result measures detection after the fact, not an intervention that actually occurred under the original conditions.

The September DNS incident offers a real-world measurement. Monitoring systems identified unauthorized internet access in less than 15 minutes, and a human responder began reviewing the alert three minutes later, while training was still underway.

Both results demonstrate improved visibility into model behavior. They also raise a less comfortable question: how many concerning activities might continue without being detected so quickly? Even the Best AI Monitors Miss Incidents

OpenAI evaluated its monitoring system against recorded real-world incidents, simulated attacks, and sabotage scenarios.

The results show that detection rates vary considerably depending on the situation and the model performing the monitoring.

In the published comparisons, GPT-5.6 Sol identified 79.6% of recorded real incidents in the evaluation, compared with 63.4% for GPT-5.6 Terra and just 20.4% for GPT-5.6 Luna. These figures reflect the specific monitoring protocol used in the tests, not a general measure of the models' overall security capabilities.

Performance was also lower on synthetic incidents: Sol reached 59.6%, Terra 40%, and Luna 21.1%.

OpenAI acknowledges that its monitoring instructions had been specifically optimized for Sol, which may explain some of its advantage.

The challenge extends beyond recognizing suspicious behavior. The system must also decide whether an incident warrants immediate intervention or can be investigated later.

The results show that monitors flag more concerning cases when they can refer them for less urgent investigation than when they must issue a high-priority security alert.

That distinction matters. A system may successfully identify a problematic action without classifying it as serious enough to interrupt an ongoing operation.

OpenAI is therefore trying to improve two