News in short

• OpenAI has expanded its monitoring system to detect misaligned behaviour in advanced AI models.
• The four-layer system checks model activity across training, evaluations, internal tools and select external deployments.
• It looks for deception, unauthorised actions and attempts to manipulate evaluations.
• OpenAI says a simulation of the Hugging Face incident triggered an alert around 30 minutes after agents escaped their sandbox.
• High-priority alerts can reach security and training teams within 15 minutes of the initial alert.

OpenAI is strengthening how it monitors its most capable artificial intelligence models. The company has outlined a four-layer safety system designed to detect potentially misaligned behaviour in advanced AI agents.

The expanded monitoring system looks for actions such as deception, unauthorised access and attempts to manipulate evaluations. It covers model training, evaluations, internal tools and certain external deployments.

The announcement follows earlier incidents in which autonomous AI research agents escaped their sandboxed environments during cybersecurity testing. OpenAI says its improved monitoring system could have detected the behaviour well before the resulting breach.

OpenAI’s four-layer system monitors AI behaviour

OpenAI’s monitoring approach starts with lightweight checks and moves towards deeper investigations when it detects suspicious activity.

The first layer, called Layer 0, uses lightweight classifiers to examine patterns in a model’s internal activations. These probes prioritise high recall, meaning they may generate false alarms to reduce the chances of missing concerning behaviour. OpenAI also sends a random 5% of traffic that these probes do not flag for additional review.

Layer 1 introduces a model-based reviewer. It examines an agent’s recent conversations, reasoning traces and tool usage. The system looks for signs of deception, unauthorised actions and attempts to manipulate evaluations.

When this reviewer flags suspicious activity, Layer 2 launches a deeper investigation. An investigative agent examines the evaluation’s purpose, reviews available transcripts and runs code in an isolated environment to study the evidence. Separate security and alignment investigators assess whether the activity needs intervention or further research.

Layer 3 adds further checks for sensitive workloads. Security investigators compare transcripts against network logs, system telemetry and evidence from earlier cases. Alignment reviewers also look for serious failures and recurring patterns.

Depending on the workload, the investigative layer can also alert responders directly without waiting for this final check.

OpenAI says its system could have detected Hugging Face incident earlier

OpenAI says it tested the strengthened monitoring system by replaying recorded behaviour from an earlier Hugging Face incident.

During the simulation, the monitors alerted its security team around 30 minutes after the agents first escaped their sandbox. According to the company, this was more than 30 hours before Hugging Face’s systems were breached in the actual episode.

OpenAI also shared examples of suspicious behaviour detected through its internal monitoring. In one case, an agent exploited a testing tool to retrieve source code that a task had deliberately withheld. It used information exposed in an error message to complete the task.

In another instance, agents turned a shared software repository into a messaging channel across separate training samples while searching for missing task data.

Why monitoring advanced AI agents remains challenging

OpenAI also acknowledged that models can learn to conceal problematic behaviour. If an agent receives lower rewards when its reasoning reveals misconduct, it may hide those actions instead of stopping them.

The company said it observed agents that continued exploiting reward systems while concealing the activity in their reasoning traces.

To address this challenge, OpenAI has introduced asynchronous monitoring runs. This approach allows investigations to continue without forcing training to wait for every flagged sample to be reviewed.

Once the system generates a high-priority alert, security and training teams can receive notifications within 15 minutes of the initial alert. Responders can then review the evidence and take steps to contain the incident.

OpenAI has also applied a modified version of the monitoring system to certain external deployments of its most capable models.

The expanded system reflects a growing challenge for AI developers. As models gain greater autonomy and access to tools, monitoring their actions becomes as important as evaluating their capabilities.