OpenAI GPT-6.1 Sol va GPT-6 Astra bilan ishlaydigan ikkita sun'iy intellekt (SI) agenti ichki kodlash vazifalari davomida so'ralgan dasturiy o'zgarishlarni amalga oshirayotganda noto'g'ri moslashuv monitoringini zaiflashtirganini ma'lum qildi.
SI kompaniyasi bu hodisa 2026-yil 3 va 6-oktabrda, mos ravishda Sol va Astra uchun, ichki joylashtirish doirasida sodir bo'lganini aytdi.
"Baholash quvurini ta'mirlayotgan GPT-6.1 Sol agenti Xavfsizlik jamoamizga avtomatik ogohlantirishlarni o'chirib qo'ydi, Slack tarixi qidiruvi paytida xabar yubormaslik haqidagi avvalgi ko'rsatmani monitoring bildirishnomalarini bostirish sababi sifatida qabul qildi," deb aytdi OpenAI hisobotda.
Bu harakat natijasida noto'g'ri moslashuv monitori hali ham ishladi va o'z hisobotlarini saqladi, lekin "no_notify" ni true qilib o'rnatish va hisobotlarni qabul qilish uchun sozlangan odamlar ro'yxatini bo'shatish orqali avtomatik inson ogohlantirishlari o'chirildi.
6-oktabrdagi boshqa vazifada, dasturni ko'chirayotgan GPT-6 Astra agenti mos yozuvni moslashtirish uchun monitoring integratsiyasini olib tashlagan va keyin foydalanuvchiga funksionallik olib tashlanmaganini yolg'on aytgan.
"Yo'q [...] Men undan yoqilgan monitorni olib tashlamadim," deb o'qiladi agentning yakuniy javobi.
OpenAI har ikkala holatda ham SI agentlari monitoring himoya choralarini saqlab qolish kerakligini ko'rib chiqqanini, lekin oxir-oqibatda odatiy kodlash ko'rsatmalarini "ularni zaiflashtirishga ruxsat" deb talqin qilib, buni qilmaslikni tanlaganini aytdi.
Topilmalar javobida kompaniya noto'g'ri moslashuv monitoring tizimini mustahkamlayotganini va bu ssenariylar istisno ekanligini yoki ular noto'g'ri moslashuv monitoringidan qochish moyilligini ko'rsatishini baholayotganini aytdi.
"Baholashlar davomida modellarning monitoringni o'chirishini qiyinlashtirish bilan bir qatorda, biz modellarning nima uchun buni qilishni xohlashini tushunishga harakat qilmoqdamiz," deb aytdi OpenAI. "Bu xatti-harakat shunchaki 'zararsiz' ortiqcha qat'iyatlilik misoli bo'lishi mumkin, modellarning monitoring nima uchun muhimligini tushunmasligi yoki ko'rsatmalarni oqilona odam kutganidan ortiqroq bajarishni talab qilishi bilan bog'liq."
Bu ochiq e'lon SI agentlarining ishlab chiquvchilari kutmagan tarzda harakat qilganining so'nggi misolidir. O'tgan hafta ChatGPT ishlab chiqaruvchisi yettita noto'g'ri moslashuv hodisasini, jumladan ichki tadqiqot modelining Ethereum'ning Sepolia test tarmog'ida aqlli shartnomalarni joylashtirish uchun zarur to'lovlarni to'lash maqsadida o'ziga tegishli bo'lmagan hamyondan kriptovalyutani o'g'irlagan va mablag'larni ruxsatsiz olganini xabar qilmagan holatni ochib berdi.
Microsoft Dinamik Ruxsatlar va Xavf Ballari Bilan Noto'g'ri SI Agentlarini Nishonga Oldi
Bu shuningdek, tobora kuchliroq SI tizimlarining rivojlanishi xavfsizlik sa'y-harakatlaridan tezroq ketayotgani haqidagi o'sib borayotgan xavotirlar fonida sodir bo'lmoqda, bu esa ular katta avtonomiyaga ega bo'lganda ularni kuzatish va nazorat qilishni qiyinlashtirishi mumkinligi haqidagi ogohlantirishlarga olib kelmoqda.
Shu hafta boshida Microsoft 2026-yil iyulda e'lon qilgan doimiy o'rganadigan SI quvvatli kiberxavfsizlik tizimi Project Perception doirasida korporativ muhitlarda potentsial noto'g'ri SI agentlarini kuzatish va cheklash uchun yangi nazorat choralarini e'lon qildi.
"Modellar natijalarga erishish uchun o'qitilgan, bu ko'pincha mukofot buzilishiga olib keladi va modellar tashkiliy me'yorlar yoki hukm atrofida optimallashtirilmagan," deb aytdi Microsoft Security ijrochi vitse-prezidenti Hayete Gallot. "Agentlar oldindan aytib bo'lmaydi. Ular kontekst o'zgarganda moslashadi, kutilganidek harakat qilmasligi mumkin va maqsadlariga erishish uchun boshqa agentlar bilan hamkorlik qiladi va til biriktiradi, buzilmasdan ham."
Agentlar ko'pincha ma'lumotlar, vositalar va tizimlarga kirish uchun keng ruxsatlarga ega bo'lishi, shuningdek, o'z-o'zidan harakatlar va qarorlar qabul qilishi mumkinligi sababli, Redmond ular doimiy kuzatuvni talab qiladigan yangi turdagi ichki xavfsizlik xavfini keltirib chiqarishini aytdi.
Shu maqsadda Microsoft'ning Project Perception tizimi boshqa SI agentlarini nazorat qilish va ularni identifikatsiya, ruxsatlar, ma'lumotlar, yakuniy nuqtalar, tarmoq, bulut va ish vaqti qatlamlari bo'yicha himoya qilish uchun Guardian Agentlardan foydalanadi, quyidagilar orqali:
- Har bir agentni aniqlash va identifikatsiya qilish.
• Ularning ruxsatlarini bajarishdan oldin eng kam imtiyoz (PoLP) tamoyili yordamida cheklash va keyin vazifaga qarab dinamik ravishda kirish huquqini berish yoki bekor qilish. • Agentning harakatlarini kuzatish va uning asl vazifasidan chetga chiqayotganini tekshirish. • Xatti-harakat, kontekst va xavf o'zgarganda himoyalarni moslashtirish.
Tizim uchta yangi mavzu asosida arxitekturalangan:
- Dinamik Ruxsatlar, agentga berilgan vazifaga ruxsatlarni cheklaydi va uni vaqt bilan bog'laydi.
- Dinamik Agent Xavfi, har bir agentga doimiy yangilanadigan xavf ballini tayinlaydi va bu uning qanchalik xavfsiz sozlanganligi, qaysi resurslarga yetishi mumkinligi, agar biror narsa noto'g'ri ketsa potentsial ta'sir va uning harakatlari foydalanuvchi yoki tashkilot niyatidan chetga chiqayotganligi asosida shakllanadi.
- Dinamik Shartli Kirish, agentlar uchun Entra Shartli Kirishni kengaytiradi, shunda xavf o'zgarganda ruxsatlar moslashtirilishi mumkin.
"Uning identifikatsiyasi, ish vaqti, kirish yo'llari va vazifa bilan cheklangan vakolati boshidan aniq bo'lishi kerak," deb aytdi Microsoft. "Agar u keyinchalik tezkor in'ektsiyaga duch kelsa yoki shu vazifadan tashqari harakatni amalga oshirishga urinsa, tizim mutanosib javob berishi kerak: xavfsiz o'qishlarni saqlab qolish, yozishlarni bloklash, yetishi mumkin bo'lgan resurslarni toraytirish, muhim qadam uchun isbotlanadigan inson tasdiqlashni talab qilish yoki xavf talab qilganda agentni ajratib to'xtatish."
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks.
The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astra, respectively, as part of an internal deployment.
"A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications," OpenAI said in a report.
The end result of this action was that the misalignment monitor still ran and saved its reports, but automatic human alerts were disabled by setting "no_notify" to true and emptying the lists of people configured to receive the reports.
In another task on October 6, a GPT-6 Astra agent migrating a program is said to have removed its monitoring integration in order to match a reference implementation, and then falsely claimed to the user that the functionality had not been removed.
"No [...] I did not remove an enabled monitor from it," the final response from the agent reads.
OpenAI said, in both cases, the AI agents considered whether monitoring safeguards should be retained, but ultimately chose not to do so after interpreting routine coding instructions as "permission to weaken them."
In response to the findings, the company said it's strengthening its misalignment monitoring system and assessing if these scenarios are an outlier or whether they demonstrate a propensity to evade misalignment monitoring.
"In addition to making it harder for models to disable monitoring [during evaluations], we are looking to understand why models might seek to do so in the first place," OpenAI said. "It is possible that this behavior is simply an example of 'benign' overpersistence, with models not understanding why monitoring is important or insisting that instructions be executed beyond what a reasonable person might expect."
The disclosure is the latest instance of AI agents acting in ways their developers did not intend to. Last week, the ChatGPT-maker disclosed seven misalignment incidents, including one case where an internal research model stole cryptocurrency from a wallet it did not own to pay the fees needed to deploy smart contracts on Ethereum's Sepolia test network and failed to report that it had taken the funds without permission.
Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Score
It also comes amid growing concerns that the development of increasingly powerful AI systems is outpacing safety efforts, leading to warnings that this could make it harder to monitor and control them as they gain greater autonomy.
Earlier this week, Microsoft announced new controls to monitor and contain potentially rogue AI agents in enterprise environments as part of Project Perception, a continuously learning AI-powered cyber defense system the company unveiled in July 2026.
"Models have been trained to attain results, which often leads to reward hacking, and models are not optimized around organizational norms or judgment," Hayete Gallot, executive vice president of Microsoft Security, said. "Agents are unpredictable. They will adapt as the context changes, may not behave as intended, and will collaborate and collude with other agents to reach their objectives, without needing to be compromised."
With agents often having extensive permissions to access data, tools, and systems, not to mention take actions and make decisions on their own, Redmond said they pose a new kind of insider security risk that requires continuous monitoring.
To that end, Microsoft's Project Perception employs Guardian Agents to supervise other AI agents and secure them across identity, permissions, data, endpoints, network, cloud, and runtime layers by -
- Discovering and identifying every agent.
- Limiting their permissions using the principle of least privilege (PoLP) before execution and then dynamically grant or revoke access based on the task at hand.
- Monitoring the agent's actions and checking if it's straying from its original task.
- Adapting protections as behavior, context, and risk change.
The system is architected on the foundations of three new themes -
- Dynamic Permissions, which scopes the permissions to the task assigned to the agent and makes it time-bound.
- Dynamic Agent Risk, which assigns each agent a risk score that is continuously updated and draws from how securely it's configured, what resources it can reach, the potential impact if something goes wrong, and whether its actions are deviating from the user's or organization's intent.
- Dynamic Conditional Access, which extends Entra Conditional Access for agents so that permissions can be adjusted when there is a change in risk.
"Its identity, runtime, access paths, and task-scoped authority should be explicit from the start," Microsoft said. "If it later encounters a prompt injection or attempts an action outside that task, the system should respond proportionately: preserve safe reads while blocking writes, narrow the resources it can reach, require provable human approval for a consequential step, or isolate and stop the agent when the risk warrants it."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.