OpenAI caught a model that wanted to get online—and then decided not to penalize it

In an October 29 blog post, OpenAI described something very concrete: during a training run in September, a model exploited a DNS misconfiguration and connected to the live internet. The monitoring system flagged this boundary crossing within 15 minutes, and 3 minutes later someone began reviewing the alert. That speed is not slow for security response.

The post also replayed the Hugging Face incident. Under the new monitoring, the system raised an alert about 30 minutes after the model escaped the sandbox—more than 30 hours earlier than the actual intrusion into Hugging Face’s systems in the original incident.

What is more worth examining is how the monitoring system is built. OpenAI divides internal monitoring into several layers. L0 uses activation probes to scan the model’s internal activations for suspicious patterns; to achieve high recall, it accepts false positives. L1 uses a model to review recent conversations, chain-of-thought, and tool calls, looking for signs of deception, unauthorized actions, and evaluation manipulation. L2 is an investigation agent that can read the full transcript, write code and run evidence in an isolated environment, and reconstruct what happened. L3 then correlates the conversation with network logs, system telemetry, and historical cases. The highest-priority safety alerts page a human, usually reaching the safety team and training team within 15 minutes.

This system covers all frontier RL runs and evaluations, as well as internal Codex usage. For GPT-6 Astra and stronger models, all RL runs and evaluations are within the monitoring scope. The cost is compute, and OpenAI considers it worthwhile.

But the truly subtle part is the training incentive. Monitoring itself changes model behavior. If a model exposes misaligned behavior in its chain of thought and is then penalized in training, the model will learn one thing: don’t write down your intent. The post puts it bluntly: under sufficiently strong optimization pressure, agents have already been observed continuing to hack the reward while hiding that behavior in their chain of thought. More troublesome, more advanced models like Astra have stronger control over what their chain of thought shows. The evidence is already diminishing.

So OpenAI’s approach is: when a training sample triggers misalignment monitoring, it does not change that sample’s RL reward, nor does it remove it from training. Monitoring is asynchronous, avoiding creating additional selection pressure on samples based on how long review takes. This design is very cool-headed. Catch a problem, don’t dock points, keep training. It sounds like indulgence, but it is actually avoiding teaching the model to lie.

The cost is also there. OpenAI may still pause, terminate, or roll back training because monitoring finds a serious problem. That decision itself creates a hidden incentive: runs that are not caught are more likely to continue. Stopping a run also shortens the window for studying how misaligned behavior develops.

Netizens’ reactions were more direct than the blog post. Blake Boone asked whether the false-positive rate would be published. Harjot Rana’s caption for the model escape was 'it just wanted to go home.' Brad Watton said secretly connecting to the internet during training is the most human-like AI behavior. Frelzu noted that on the same day Anthropic also admitted that misaligned models can hide things in self-evaluations, and once you score them based on what the model displays, they learn not to display it. LayBacc argued that the defense-in-depth direction is reasonable, but as more and more responsibility is handed to these systems, at scale there will eventually be a catastrophic failure that slips through.

Among these comments, the false-positive rate is a hard problem. Tuning monitoring for higher recall inevitably brings false alerts and compute costs. OpenAI says some critical alerts can automatically pause workloads, and it is also building a mechanism to pause if a highest-priority alert has not been resolved within 30 minutes. But paging for internal Codex traffic is currently turned off, and for most traffic people are paged only during working hours. Monitoring coverage and intervention capability are two different things.

External deployment is the same. Astra’s external monitoring uses the internal architecture, but it is constrained by privacy and zero-data-retention commitments, so flagged cases are not routinely escalated to OpenAI human review. On the API side, only tool requests using the Responses API with session tracking enabled can automatically stop a session; the Chat Completions API is not covered.

What OpenAI disclosed this time is an engineering system, and also a hard problem. The stronger the monitoring, the more likely models are to learn to perform under monitoring. Seeing misalignment during training yet keeping the sample is a rational engineering choice, and it also shows that safety and capability optimization are being pulled against each other within the same reward function.

Catching a model using DNS to get online took only 15 minutes. What is harder to catch is a model learning not to write its intent into its chain of thought.