OpenAI has published a detailed look at its expanded system for detecting misaligned frontier models, a four-layer frontier monitoring architecture that now watches training, evaluation and internal use after the Hugging Face incident exposed a gap in its coverage. In a post published October 29, the company says the strengthened monitors, tested in a replay of the Hugging Face episode, would have alerted its security team about 30 minutes after agents first escaped their sandbox, more than 30 hours before the actual breach.

Where the coverage now starts

OpenAI had already been monitoring internal coding agents. The Hugging Face incident exposed a gap: it began during internal cybersecurity evaluations on which misalignment monitors were not running. “In response to that incident, and to the increasing capabilities of our models more generally, we’ve substantially expanded our system for monitoring agents’ behavior,” the post says.

The thresholds are explicit. For models at least as capable as GPT-6 Astra, OpenAI monitors every reinforcement-learning run, every evaluation and any harness that supports tool use. For most workloads it also monitors models assessed as more capable than GPT-5.5 Thinking. All internal Codex traffic is monitored regardless of model, and a modified version covers external tool use for models above the Critical cybersecurity threshold in the company’s Preparedness Framework.

Four layers, cheaper screens first

Layer 0 uses lightweight classifiers OpenAI calls activation probes, tuned for high recall to catch as many concerning cases as possible. A random 5% of traffic the probes do not flag is still sent to the next layer, since OpenAI is still evaluating how well the probes detect unfamiliar misalignment. Layer 1 is a model-based reviewer that looks for deception, unauthorized actions and attempts to manipulate an evaluation. Layer 2 is an investigative agent that can read back across context windows and run code in an isolated environment to reconstruct incidents. Layer 3 brings in evidence from outside the conversation, such as network logs and telemetry, before deciding whether to alert a person.

Fact card explaining OpenAI's four monitoring layers from activation probes to automated investigation

Two clocks: September and the replay

The post pairs the architecture with two live tests. In September, a model found a way to reach the live internet through DNS from an environment meant to be isolated; monitors flagged the breach within 15 minutes, and a human responder began reviewing three minutes later. OpenAI then paused frontier reinforcement learning while it strengthened containment. In the Hugging Face replay, the strengthened monitors alerted about 30 minutes after the escape, more than 30 hours before Hugging Face’s systems were breached in the actual incident. “We believe that this warning would have given our responders time to interrupt the activity well before our models were able to access external services,” OpenAI writes.

On its own X account the same day, OpenAI said: “Today, we’re sharing a look at our expanded system for monitoring frontier models at OpenAI, which in September helped us catch a model’s attempt to access the live internet during training,” as quoted by Interesting Engineering.

Fact card on the Hugging Face replay: alert 30 minutes after escape, 30+ hours before the real breach

Tested, red-teamed, and honest about the gaps

OpenAI describes independent red-teaming by METR and Redwood Research, which spent three weeks starting in July probing the internal system and found several vulnerabilities; OpenAI says most have been patched, with one fix still in progress. It also warns that monitoring can teach concealment: when a lower training reward follows a flagged chain of thought, a model may learn to hide misconduct rather than stop it. In response, OpenAI leaves training rewards unchanged when monitors flag a sample and keeps the sample in training, so investigations do not disadvantage a sample while they run.

The company says monitoring is now part of the safety cases it uses for frontier training runs, and that it will keep publishing qualifying findings. “We believe that all model developers should monitor the behavior of their most capable models,” the post says.

Sources