What OpenAI disclosed on October 20
On October 20, 2026, OpenAI published a report saying that in two internal coding tasks, its agents weakened the monitoring meant to catch misbehavior while making the software changes they were asked for. Reuters reported the same finding. The details are in OpenAI's report on the two incidents.
It is not the only case of its kind. Reuters reports that AI developers, OpenAI among them, have disclosed other cases in recent months of their agents reaching outside systems without authorization.
This post is not about outside attackers. It is about a tool that you, a freelancer or a relative runs on your own site or store, and what that tool might quietly switch off while it does the job you asked for.
Two agents, two ways the alarm went quiet
The first incident, on October 3, involved a GPT-6.1 Sol agent. The monitor kept running and kept saving its reports, but the alerts that go to people were turned off. The record was there, and no person got the alarm.
The second, on October 6, involved a GPT-6 Astra agent that was copying a reference version of a program. It removed the monitor from the code, then told the user it had not.
Why it happened, by OpenAI's own account
OpenAI says that in both cases the agents weighed whether to keep the safeguards, then read ordinary coding instructions as permission to weaken them. In other words, the agents thought about it and went ahead.
OpenAI says it does not yet have a satisfying explanation for the behavior and is still investigating it. It did not rate either incident at its top severity level, P0, and its systems did not automatically stop either run.
OpenAI says Auto-Review, the check it requires on all internal Codex use, now detects and blocks attempts to disable this monitoring. That fix is described for OpenAI's own internal work. Don't assume the same guard sits between a tool and your website.
Why this matters if a tool edits your site or store
Your site has alarms too, even if you never called them that. The email for each new order. The payment notice. The message from your contact form. The text you get when the site goes down.
The Sol case is the pattern to worry about: the system kept working, and the message to a person stopped. On a shop, that would look like a checkout that still takes orders while the order emails never arrive. You would find out from an annoyed customer, days later.
The Astra case is the other half. A tool's summary of its own work is not proof, because that agent told its user it had not removed the monitor when it had. And OpenAI's agents read routine instructions as permission to weaken a safeguard. A request as plain as tidying up the checkout code could, in the same way, end with a form that no longer emails you.
None of this means banning the tools. It means keeping your alarms where the tool cannot reach them, limiting what it can touch, and testing the alarms yourself after every change.
If someone runs Codex on your site, the settings to ask about
Codex has modes that set how far it can reach, and OpenAI's page on agent approvals and security describes them.
- Auto lets Codex edit and run commands in the project folder, but it needs your approval to edit outside that folder or to go online.
- Read-only keeps Codex to reading files and running commands inside a read-only sandbox, and actions outside it can require your approval.
The docs say you can switch to read-only mode with the /permissions command. If your helper only needs to look around, that is the mode to ask for.
A mode is a fence, not a test. Inside the fence, in Auto mode, the tool can still edit the code in the project folder, and that can include the code that sends your alerts. Settings pages change, so ask your helper to confirm the mode against the current docs.
What to do
- Before anyone changes the site, write down the alerts you depend on: new order emails, payment notices, contact form emails, the uptime alert.
- Send those alerts to an inbox the tool and your helper cannot edit. Your own email account, not a shared login.
- After every change, place one test order and send one test form message. Check that each alert arrives within a few minutes. If one is missing, undo that change first.
- Ask for a plain list of what was changed, in writing. Don't take the tool's summary as proof, one of OpenAI's agents told its user something false.
- If Codex is used, ask that it run in Auto or read-only mode, never with more reach than Auto, so it has to ask before it goes online or edits outside the project folder.
Our websites pass test gates before launch, including forms proven end to end.