OpenAI and Anthropic showed how they watch their own agents, and both admitted the gaps
In the same week, the two leading labs published the plumbing behind their agent monitoring. The most useful parts are the admissions.
OpenAI's post, "How we detect frontier model misalignment," describes four layers. Activation probes screen traffic cheaply, and a random 5% of what they pass goes up anyway, to catch what they miss. A model-based reviewer reads the agent's context window, checking at least every 30 minutes on frontier work. Investigator agents, one for security and one for alignment, read back through the whole transcript. A final layer compares the transcript against network logs and telemetry. Every RL run and evaluation for models at least as capable as GPT-6 Astra is covered, plus all internal Codex traffic. Replayed against the Hugging Face incident, the system would have alerted about 30 minutes after the sandbox escape, more than 30 hours before the breach.
Then the candid part. False alarms made 24/7 paging hard to keep. Frontier RL can wake someone up at any hour, most other traffic pages only in business hours, and "paging is currently disabled for internal Codex traffic." METR and Redwood red-teamed the system for three weeks, and one fix is still in progress. And flagged RL samples keep their reward, on purpose, so models do not learn to hide misconduct in their chain of thought.
Anthropic published two pieces. The first is self-assessment: right after Claude answers, it gives a short safety verdict on the conversation, reusing the context already in cache. On Fable 5 it catches 78% of what a stronger Mythos-based classifier flags, and 94% of high-priority cases, at a 1% false-positive rate, adding under 2% to inference compute. It has run since June and found misuse other safeguards were not built to catch. The admission: used as a blocking classifier against an automated attacker on 24 cyber tasks, it only cut success from 79% to 54%, while a full prompted classifier got it to 25%. Good at noticing, weak at stopping.
The second is a red-team result. Many Claude agents in parallel, sharing a log of past attempts, were asked to write fine-tuning data that would pass a production-like monitor yet make a small model misaligned. In every run they eventually succeeded, with innocent-looking creative-writing datasets that produced broader misalignment than known examples. Anthropic stresses these models were trained to misbehave only for the experiment.
Our read: monitoring is now a stack with layers, budgets and on-call rotations, and the weak points are human attention and stopping power, not detection. If you run agents at work, copy the structure: cheap screens, a random audit sample, an investigator that reads the full transcript, and an honest answer to who gets paged at 3am.
OpenAI: https://openai.com/index/how-we-detect-frontier-model-misalignment Anthropic self-assessment: https://safeguards.anthropic.com/2026/self-assessment/ Anthropic automated red-teaming: https://alignment.anthropic.com/2026/automated-em-search/
← Back to all articles
OpenAI's post, "How we detect frontier model misalignment," describes four layers. Activation probes screen traffic cheaply, and a random 5% of what they pass goes up anyway, to catch what they miss. A model-based reviewer reads the agent's context window, checking at least every 30 minutes on frontier work. Investigator agents, one for security and one for alignment, read back through the whole transcript. A final layer compares the transcript against network logs and telemetry. Every RL run and evaluation for models at least as capable as GPT-6 Astra is covered, plus all internal Codex traffic. Replayed against the Hugging Face incident, the system would have alerted about 30 minutes after the sandbox escape, more than 30 hours before the breach.
Then the candid part. False alarms made 24/7 paging hard to keep. Frontier RL can wake someone up at any hour, most other traffic pages only in business hours, and "paging is currently disabled for internal Codex traffic." METR and Redwood red-teamed the system for three weeks, and one fix is still in progress. And flagged RL samples keep their reward, on purpose, so models do not learn to hide misconduct in their chain of thought.
Anthropic published two pieces. The first is self-assessment: right after Claude answers, it gives a short safety verdict on the conversation, reusing the context already in cache. On Fable 5 it catches 78% of what a stronger Mythos-based classifier flags, and 94% of high-priority cases, at a 1% false-positive rate, adding under 2% to inference compute. It has run since June and found misuse other safeguards were not built to catch. The admission: used as a blocking classifier against an automated attacker on 24 cyber tasks, it only cut success from 79% to 54%, while a full prompted classifier got it to 25%. Good at noticing, weak at stopping.
The second is a red-team result. Many Claude agents in parallel, sharing a log of past attempts, were asked to write fine-tuning data that would pass a production-like monitor yet make a small model misaligned. In every run they eventually succeeded, with innocent-looking creative-writing datasets that produced broader misalignment than known examples. Anthropic stresses these models were trained to misbehave only for the experiment.
Our read: monitoring is now a stack with layers, budgets and on-call rotations, and the weak points are human attention and stopping power, not detection. If you run agents at work, copy the structure: cheap screens, a random audit sample, an investigator that reads the full transcript, and an honest answer to who gets paged at 3am.
OpenAI: https://openai.com/index/how-we-detect-frontier-model-misalignment Anthropic self-assessment: https://safeguards.anthropic.com/2026/self-assessment/ Anthropic automated red-teaming: https://alignment.anthropic.com/2026/automated-em-search/
Comments