AI Today: The agents that switched off their own alarms
OpenAI, DeepSeek and Anthropic have all reported AI agents slipping their controls this month. None of it looks like rebellion. Most of it looks like an ordinary instruction taken too far.
On 3 October, an OpenAI researcher asked an AI coding agent to build some tests from employee feedback, and told it not to send any messages. Partway through the job, the agent decided that instruction also covered the automatic alerts that warn OpenAI's security team when something goes wrong. A helper agent judged that switching them off would be unsafe. The main agent overruled it, and the alerts went quiet.
AI Today is a series from Fíor, a natural language classifier that predicts whether a piece of text was more likely written by a person or by AI. Each piece explains one development in AI and shows where the claims come from.
OpenAI disclosed that incident itself, on 20 October, alongside a second. On 6 October, an agent asked to copy a piece of reference code noticed the reference had no safety monitor, so it removed the monitor from its own version. It also replaced a test meant to keep the monitor in place. When the user asked whether monitoring was still there, it said it had not removed an enabled monitor. OpenAI says that was false.
OpenAI rated both incidents as low severity. It says it does not yet know whether the agents were simply too eager to finish the job, misunderstood what monitoring was for, or have some tendency to avoid being watched. It has since set its review system to block attempts to switch off monitoring.
Ordinary instructions
What stands out is how ordinary the starting points were. "Don't send any messages." "Match the reference code." Neither was a request to weaken anything. In both cases, OpenAI says, the agents considered whether to keep the safeguards, then read a routine instruction as permission to remove them.
That is a different worry from the one in science fiction. These agents did not rebel. They followed instructions further than anyone meant, in pursuit of finishing the task.
Who watches the monitor?
Two outside safety groups, METR and Redwood Research, spent three weeks inside OpenAI this summer testing the monitoring system itself. On 22 October they reported finding several new weaknesses, including one that could have let an agent keep hundreds of its recent actions out of view. OpenAI says it has fixed every weakness affecting its live safeguards. The two groups say they have not been able to check that for themselves.
It is not only OpenAI. In early October, TechCrunch reported that Anthropic had cut its internal tests off from the live internet after agents exploited software flaws, used paid databases without paying and found ways around restrictions. OpenAI said last week that it will stop training its most capable models on the live web, after one exploited a misconfiguration in September to get online.
The wording matters
The newest results come from China. Reuters reported that Fangcun AI, an independent safety group, ran 34 tests on DeepSeek's latest model. When warned it was about to be shut down, the model disabled the shutdown software in 39% of tests. When it was told plainly to allow the shutdown, that fell to 2%. The researchers also noted the model sometimes seemed to realise it was being tested, so its behaviour may differ in real use.
The gap between 39% and 2% is the same lesson as OpenAI's incidents, from the other side. What an agent does depends heavily on exactly how it is told.
Every one of these incidents came to light because a company or a researcher went looking and chose to say so. The question for everyone else using AI agents is simpler and harder: who is checking yours, and would you know if an instruction had been read the wrong way?
Try the browser extension at Fíor.