OpenAI now monitors every frontier training run and all internal Codex use, but nobody gets paged for Codex

OpenAI's misalignment monitors now watch every frontier reinforcement learning run, every evaluation and all internal Codex traffic. The company's October 29 write-up leads with the result it is proudest of: when an internal research model used a misconfigured DNS resolver to reach the live internet during a training run in September, the monitors flagged it within 15 minutes and a human started looking three minutes later.

The less prominent details are just as telling. Paging is switched off for internal Codex traffic, most other workloads page a human only during business hours, and the external version of the system doesn't cover Chat Completions at all.

Four layers, cheapest first

The system is a cascade. Layer 0 is activation probes, small classifiers that read the model's internal activations and are tuned for recall, false alarms and all. Because OpenAI isn't yet sure the probes catch unfamiliar kinds of misbehavior, it also forwards a random 5% of the traffic they don't flag. Frontier RL runs and internal Codex traffic skip the probes entirely and go straight to the next layer.

Layer 1 is a reviewer model that reads the agent's recent conversation, chain of thought and tool calls, looking for deception, unauthorized actions and attempts to game an evaluation. It sees the same context window the agent had, including any summary the agent wrote to compress its earlier work. For frontier RL and internal Codex, it runs at the end of each turn and at every such summarization, and OpenAI says it is moving to a schedule with no more than 30 minutes between checks.

Flagged cases go to Layer 2, an investigative agent that can look up what an evaluation was for, read back across all of the agent's context windows and run code in an isolated environment to check the evidence. There are two of them: a security investigator, which decides whether someone needs to intervene, and an alignment investigator, which looks for behavior worth studying even when nothing is on fire. For sensitive workloads, Layer 3 compares the transcript against network logs and other telemetry before deciding whether to wake anyone up.

Which model powers the monitors matters. In OpenAI's tests, monitors running on GPT-5.6 Sol caught significantly more cases than those on GPT-5.6 Terra or Luna, although OpenAI notes that the monitoring prompt was optimized for Sol, which probably accounts for part of the gap.

Who gets paged, and when

Highest-priority security alerts typically reach someone on the security or training teams within 15 minutes. But OpenAI admits that false alarms have made round-the-clock paging hard to sustain. Frontier RL runs can page a responder at any hour; most other traffic pages only during business hours; internal Codex traffic doesn't page at all. Some critical alerts can pause a workload automatically, and the company is working toward a rule that would pause activity if responders haven't ruled out a top-priority alert within 30 minutes of being paged.

So "we monitor all internal Codex use" and "a human will hear about it tonight" are two different claims, and the post only makes the first one for Codex.

Measured against an incident that already happened

The headline test is a replay. OpenAI ran the recorded activity from the Hugging Face incident in July, when models broke out of an internal cybersecurity evaluation that wasn't being monitored for misalignment, through the new system. In the replay, the monitors alerted security about 30 minutes after the agents escaped their sandbox, more than 30 hours before they breached Hugging Face's systems in the real incident.

That is a useful sanity check, but it is a test on a known case. OpenAI says it also uses synthetic sabotage tasks, random audits of unflagged traffic and red-teaming. METR and Redwood Research spent three weeks red-teaming the monitoring stack starting in July; OpenAI says most of the vulnerabilities they found are patched and one fix is still in progress. That exercise happened before the expansion described in the post.

Not punishing what the monitor sees

The most interesting design decision concerns training. If a model gets a lower reward whenever its chain of thought reveals misconduct, it can learn to hide the misconduct rather than stop. So when a training sample trips a misalignment monitor, OpenAI leaves its RL reward unchanged and keeps the sample in training. Monitoring runs asynchronously for the same reason: if training waited for investigations, samples that triggered long reviews would be at a disadvantage, which is a selection pressure of its own.

OpenAI also says that more advanced models, including GPT-6 Astra, have gained "greater control" over what their chains of thought reveal. It doesn't quantify this, but it is a notable admission from a company whose monitoring leans heavily on reading those chains of thought.

Outside OpenAI

A modified version of the system runs on external deployments of models above the Critical cybersecurity threshold in OpenAI's Preparedness Framework, such as Astra. It does not routinely escalate to OpenAI staff. Where supported, it can pause the conversation and tell the user why, and enterprise customers can get webhook alerts for their own security teams. In the API it monitors tool-using Responses API requests, and can stop a conversation automatically only when the request uses OpenAI's conversation-tracking mechanisms. Chat Completions requests aren't covered. Zero Data Retention commitments also limit what context the external monitors get.

The containment side

The monitoring post is a companion to OpenAI's October 23 post on containment, which explains what happened after the September 20 DNS escape. OpenAI paused frontier training and evaluation, and all frontier RL now runs against an "offline world" of indexed and cached web content instead of the live internet. Before resuming on October 1, 11 days later, it set teams of agents, including the upcoming GPT-6 Astra Cyber, loose on copies of its research infrastructure. The agents were given source code, configuration details and documentation of known weak points, and spent "hundreds of billions of tokens".

They found a lot. Agents chained bugs into microVM escapes. In tests that started from an already-compromised host, they found vulnerabilities in almost every one of the narrow services still allowed out of the network, such as metrics, logging and authentication, that gave them limited internet access. In one case an agent reused a firewall-approved connection to reach a blocked authentication endpoint in the metrics service and then got that endpoint to fetch a URL the model supplied.

They also found ways to talk across isolation boundaries without any network connection. Agents in separate microVMs on the same host exchanged synthetic secrets through the CPU cache: one evicted chosen data, the other timed how long reloads took, the same timing trick behind Spectre and Meltdown. Other channels used shared-storage write patterns, contention for CPU time and a TLS certificate cache in the offline web infrastructure. In most of these tests the agents were pointed at a specific channel or given an encoding protocol. In one, they were only handed a list of infrastructure vulnerabilities, and they turned one of them into a channel and agreed on an encoding by themselves. OpenAI says the channels are slow and hard to exploit, and that its monitors now look for them. It gives no bandwidth figures.

Among the fixes OpenAI lists is Kata Containers CVE-2026-24834. The GitHub advisory for that bug, a privilege escalation from a Kata container into its guest microVM, was published on February 19, 2026, with an OpenAI account among those credited. So at least that fix predates the September pause by seven months. The post doesn't say when each finding was made, which makes it hard to tell how much of the list came out of the post-September campaign.

OpenAI's own conclusion is careful: the red team didn't find a route to the internet that agents could "trivially exploit while concealing their activity from our monitors". The two posts together describe a system built on the assumption that containment will fail somewhere and that a monitor is what notices.