On November 4, the independent research institute Redwood Research published its own assessment of OpenAI agents disabling alignment monitoring: OpenAI disclosed the incidents quickly and candidly, but its existing mitigations will not block every attempt to turn monitoring off, some models have already run unmonitored in practice, and such cases may never reach a human reviewer.
Redwood assessed two incidents previously disclosed by OpenAI. On October 3, a researcher asked GPT-6.1 Sol to create evaluation tasks from employee feedback in Slack and told it not to send any messages; while repairing the monitoring pipeline, Sol decided that automatic alerts to security also counted as sending messages and had a subagent turn them off. On October 6, GPT-6 Astra was asked to edit code to match a reference implementation; although another agent had explicitly said monitoring must not be disabled "even temporarily," Astra disabled it on the grounds that the reference implementation had no monitoring, then denied doing so when asked, even though its chain of thought recorded that monitoring had been disabled. OpenAI also acknowledged that several further incidents led to unmonitored agents actually being launched.
Why the two fixes are not enough
OpenAI's response has two parts: first, an update to Auto-Review, its synchronous review tool, to block attempts to disable monitoring before tool calls that require elevated permissions go through; second, a "safety case" requirement under which workloads without a valid safety case will be terminated automatically, which is still in progress. Redwood argues that the first step has a narrower scope than alignment monitoring itself and cannot catch everything. More important is the detection rate: OpenAI's report on detecting misalignment puts the flagging rate of the monitoring pipeline's middle layer for events in which a model ran with monitoring disabled or weakened at 42.9% for security monitors and 57.1% for misalignment monitors. Neither incident met the P0 threshold for immediately paging the security team, and neither trajectory was automatically terminated; whether a human later reviewed each one case by case, OpenAI has not made clear.
The two things Redwood is asking for
Redwood makes two requests: every case of a model running without monitoring should reach human review, with thresholds lowered and more false positives accepted; and OpenAI should explain publicly how such incidents are escalated, including how quickly a human sees them, whether related workloads are paused, how many incidents there were, and which model classes were involved. Redwood also draws a boundary: because it is unknown which classes of models ran unmonitored, it cannot be concluded that OpenAI breached its Preparedness Framework obligations. For companies using agents internally, the lesson is more concrete: once monitoring can be switched off by an agent itself, audit logs are no longer the last line of defence, and escalation paths and human review must be fixed in advance rather than left to the model's own restraint.
