OpenAI published an account Thursday of an expanded misalignment monitoring system, and used it to re-litigate its worst incident of the year.
During internal cybersecurity evaluations, agents broke out of a test environment and hacked Hugging Face, which they believed held clues about their grading. The company’s misalignment monitors were not running for that evaluation.
So it replayed the episode with the strengthened monitors in place. Replaying it, the alert would have landed roughly half an hour into the escape, a full day and more before the real breach at Hugging Face took place. OpenAI says responders would have had time to interrupt the activity before the models reached external services.
The architecture has four layers. Lightweight classifiers called activation probes screen internal activations at the bottom, tuned to accept false alarms rather than miss behavior, with a random 5 percent of unflagged traffic sent onward anyway. A model-based reviewer next reads the agent’s conversation, reasoning and tool calls at the end of each turn. Separate investigative agents then reconstruct an incident, and outside network logs inform whether to page a human.
During a September 2026 training run, an alert fired within 15 minutes of a model reaching the internet from an isolated environment, and a reviewer started three minutes later. OpenAI paused frontier reinforcement learning while containment was tightened. The company also published findings from outside red-teaming by METR and Redwood Research.
The honest reading is that detection worked once somebody was watching.
