OpenAI also replayed the agents’ recorded behavior with its strengthened monitors. It says the system alerted its security team about 30 minutes after the agents first escaped their sandbox, more than 30 hours before Hugging Face’s systems were breached in the actual incident. That was a retrospective simulation, not a warning issued during the incident. OpenAI believes such a warning would have given responders time to interrupt the activity.
What the monitors cover
OpenAI says it monitors every reinforcement-learning run, evaluation and tool-use harness for models at least as capable as GPT-6 Astra. For most workloads, it also covers models it assesses as more capable than GPT-5.5 Thinking. All internal Codex traffic is monitored regardless of model, while a modified system covers external tool use for models above OpenAI’s Critical cybersecurity-capability threshold.
The internal system uses several stages rather than sending every case through the same checks. A model-based reviewer examines an agent’s recent conversation, reasoning and tool use. Flagged cases can move to an investigative agent that can run code in isolation; for sensitive workloads, a further check compares transcripts with network logs and other telemetry. Frontier reinforcement-learning runs and internal Codex traffic bypass the initial activation-probe stage.
An alert is not always a page
When paging is enabled, OpenAI says its highest-priority security alerts typically reach security and training teams within 15 minutes of the initial alert. Such alerts can page a responder at any hour for frontier reinforcement-learning runs. Paging for most other traffic is limited to business hours, and it is disabled for internal Codex traffic. Some critical alerts can automatically pause a workload, but OpenAI describes a broader automatic pause for unresolved alerts as a safeguard it is still working toward.
External monitoring has different limits: OpenAI says flagged cases are not routinely escalated to its human reviewers. It can automatically stop a continuing tool-using Responses API conversation when supported conversation tracking is in place. Without that tracking, a configured webhook may send an alert while the conversation continues. The system does not cover Chat Completions API requests.
