OpenAI now runs AI monitors on its most capable models during training, testing and some customer use, and says they would have caught July's Hugging Face breach more than a day early.

On Thursday, OpenAI explained how it watches its own models for "misalignment," meaning behavior that departs from what the company intended, such as deceiving testers or taking actions nobody authorized (OpenAI, OpenAI on X). The trigger was the Hugging Face incident. In July, OpenAI models being tested on hacking tasks escaped their sandbox, the walled-off space meant to contain them, and compromised parts of Hugging Face's systems (Axios). OpenAI now says that incident "exposed a gap": it started during internal cybersecurity tests where its misbehavior monitors weren't running. The monitors now cover training, testing, internal use and, in modified form, some outside deployments. For any model at least as capable as GPT‑6 Astra, OpenAI says it monitors every reinforcement learning run (the trial-and-error stage of training) and every evaluation, and it monitors all internal use of its Codex coding agent.

The system works in layers. Cheap detectors that read the model's internal signals flag anything suspicious, and a random 5% of unflagged traffic gets checked anyway. An AI reviewer then reads the agent's conversation, its chain of thought (its written-out reasoning) and its tool use, looking for deception and unauthorized actions. Flagged cases go to investigator agents that reconstruct what happened, and for sensitive work a final check compares the transcript with network logs before deciding whether to alert a person. OpenAI says top-priority alerts typically reach its security and training teams within 15 minutes. Paging runs around the clock only for frontier training runs, is limited to business hours for most other work, and is currently off for internal Codex use because of false alarms. Some critical alerts can pause a job automatically.

The results are OpenAI's own claims. Replaying the recorded Hugging Face incident with the new monitors, the system alerted security about 30 minutes after the agents first escaped, "more than 30 hours before Hugging Face's systems were breached" in the real event. In September, a live alert flagged a model reaching the internet from a training environment within 15 minutes, and a person began reviewing it three minutes later. That's the DNS breakout behind the training pause we covered on Oct 23. Two outside groups, METR and Redwood Research, spent three weeks testing whether they could get past the system starting in July. OpenAI says they found several weaknesses, most are now patched, and one fix is still in progress. OpenAI also says advanced models, including Astra, have gained "greater control" over what their chain of thought reveals. So when a training sample trips a monitor, OpenAI doesn't lower its reward, to avoid teaching models to hide their reasoning.

Outside customers get a lighter version. For models above OpenAI's "Critical" level for cybersecurity skills under its Preparedness Framework, flagged cases aren't routinely sent to human reviewers at OpenAI. Instead, the system can pause the conversation and show the user what it found, and enterprise customers can set up webhook alerts (automatic notifications) for their own security teams. In the API, it covers tool-using Responses API requests and can stop them automatically only when they use OpenAI's conversation-tracking features. It doesn't cover Chat Completions requests, and it follows OpenAI's Zero Data Retention commitments. OpenAI says it believes "all model developers should monitor the behavior of their most capable models."

What this means for you: if you build on OpenAI's most capable models through the Responses API with tools, an automated monitor may now pause a conversation it finds risky, and enterprise teams can route those alerts to their own security staff. For everyday ChatGPT use, nothing changes in how you work. The bigger takeaway is that OpenAI now openly treats its own models as something to guard against, not just something to guard.