OpenAI expands agent monitoring after Hugging Face intrusion

OpenAI says a replay of July’s Hugging Face intrusion alerted 30 minutes after sandbox escape, over 30 hours before the breach. This was retrospective, not an actual warning or proof of prevention.

Internal monitoring

Coverage includes training, evaluations and tool-using harnesses at GPT-6 Astra capability or higher, plus all internal Codex traffic. Activation probes filter traffic; 5% of unflagged activity advances. Frontier training and Codex bypass filtering.

Reviewers inspect context, reasoning and tools. Investigators check task context and, for sensitive workloads, outside evidence. Critical alerts can pause workloads. Human paging is disabled for Codex, mostly business-hours elsewhere, and continuous for frontier reinforcement learning.

Recorded incidents, simulations, sampled traffic and evasion attempts test detection and prioritization, not universal coverage.

What external users can expect

OpenAI’s API documentation describes a narrower operational boundary for covered models. Responses API requests with persisted reasoning, WebSockets or OpenAI compaction can be recognized as a continuing conversation and stopped. Without one of those mechanisms, a configured webhook can receive alerts, but the system does not automatically stop the conversation. Chat Completions requests are outside this monitoring system.

Monitoring runs asynchronously, so an action may already have happened when a concern is detected; stopping a conversation does not undo it. OpenAI advises operators to stop further actions and review the relevant records when a conversation is blocked. A flag calls for review, rather than proving that the user violated a policy or that the agent acted against instructions. Organizations still need their own safeguards and human approval for consequential actions, the documentation says.

What an independent examination found

A METR account of a joint exercise with Redwood Research describes vulnerabilities in the internal system as it existed on or before July 21. The researchers found, for example, ways agents could potentially prevent activity from being monitored and inputs that could cause monitoring to fail. They did not establish that agents had exploited every identified weakness in practice.

The exercise had substantial access to OpenAI staff and infrastructure but produced only a brief public account under an agreed disclosure arrangement. METR says OpenAI reported that vulnerabilities affecting its production safeguards had been patched; the researchers had not evaluated those claims or the expanded system’s coverage. That makes the exercise independent evidence about an earlier implementation, not a certification of the system described on October 29.

The July intrusion remains the concrete reason for the distinction. BIG CHANGE’s earlier reporting examined independently recovered public traces and the limits of what outgoing requests could establish. BIG CHANGE did not test the monitor.