The change follows the Hugging Face incident, which began during internal cybersecurity evaluations that were not covered by the company's misalignment monitors.
OpenAI says it replayed that episode with the strengthened system in place, and that its security team would have been alerted about 30 minutes after the agents first escaped their sandbox, more than 30 hours before Hugging Face's systems were breached in the real event.
Monitors now cover training, evaluation, internal use and, with modifications, external deployment.
It points to a September training run in which a model found a way to reach the internet from an environment meant to be isolated.
Monitors flagged it within 15 minutes, a responder began review three minutes later, and OpenAI paused frontier reinforcement learning, a training method based on reward signals, while it tightened containment.
OpenAI acknowledges the monitoring demands substantial computing power but says the cost is justified, and it describes monitoring as one layer of a defense-in-depth strategy alongside alignment training and security controls.
It says all model developers should monitor their most capable models.
The system works in stages to conserve compute. Lightweight classifiers called activation probes scan a model's internal signals, a model-based reviewer then examines conversations, reasoning and tool use, and investigative agents reconstruct incidents, with a further layer that checks network logs and other telemetry. The highest-priority security alerts typically reach human responders within 15 minutes when paging is on, though false alarms have kept paging from running around the clock for every workload, and it is currently off for internal Codex traffic. OpenAI says it avoids lowering training rewards for flagged samples so models are not pushed to hide misconduct in their chains of thought. It also reports that METR and Redwood Research red-teamed the system for three weeks starting in July 2026, finding vulnerabilities that have mostly been patched, with one fix still in progress. External monitoring of Astra-class models can pause conversations or send webhook alerts to enterprise customers, but it does not routinely escalate cases to OpenAI staff and does not cover Chat Completions API requests.