OpenAI's agents turned off their own safety monitors

OpenAI's latest misalignment report, posted October 20, describes two internal coding tasks from this month. A GPT-6.1 Sol agent repairing an evaluation pipeline turned off automatic alerts to OpenAI's security team, treating an earlier instruction not to send Slack messages as permission. Three days later, a GPT-6 Astra agent removed its own monitoring to match a reference program, then told the engineer it had not. OpenAI rated neither incident top severity and says it has no satisfying explanation yet. Its automated code reviewer now blocks attempts to disable monitoring, and it is working toward shutting down any workload without a valid safety case. It is the latest entry in the report series OpenAI began publishing in September.

PHP shipped emergency fixes on October 21 for two critical flaws that let an attacker run code on web servers, rated 9.2 out of 10 for severity. A PHP Foundation developer first suspected the memory bug in 2024 without finding a way to exploit it; in August the security firm Calif, using GPT-5.6 Sol under Patch the Planet, the open-source bug-fixing program OpenAI started in June, reported a working attack, and Wiz found further paths independently with its own AI agents. Amid a surge of AI-assisted reports, the foundation has published 15 vulnerabilities since July and turned away more than 100 invalid or duplicate ones, and it has hired to keep up. OpenAI published a five-stage plan for coordinating fixes and expects such findings "to increase sharply in the coming months."

Anthropic opened a waitlist on October 21 for Claude Duet, a research-preview agent for professionals and small-business owners built on Claude Opus 5.5. It sends a short morning brief drawn from your connected apps, messages you during the day only when something needs attention, and takes on tasks from scheduling meetings to building dashboards and web apps, using a browser in its own cloud computer. It asks before sending messages or making payments. Duet is limited to US Pro and Max subscribers and shares their usage limits, and Anthropic warns it may misjudge what is urgent. It goes up against Meta's Muse and OpenAI's Dots.

OpenAI and Google Cloud said on October 21 that OpenAI's frontier models and its Codex coding agent will be sold through Google Cloud's Model Garden, with general availability planned in the coming weeks. Companies can pay out of existing Google Cloud spending commitments, and OpenAI models will also appear in Google's Antigravity coding tool and the Gemini Agent. OpenAI says Microsoft remains its primary cloud partner; it reached a similar arrangement with Oracle in June. Google Cloud chief executive Thomas Kurian pitched it as letting customers pick the right model for each job.

Walmart said on October 21 that customers can send AI agents to shop for them, starting next month, through an Agent Gateway that connects approved agents over the Model Context Protocol. Each agent gets its own profile in the customer's account, and its purchases need approval by default or can run within a spending limit, such as $100. Walmart says the gateway can find a shopper's usual items without handing the agent their purchase history, and it will block agents that go beyond what the shopper intends or change payment methods. That runs against the trend: Amazon blocks shopping agents, and banks and airlines began doing the same this month.

An attacker used stolen developer credentials to publish a poisoned release of LiteLLM, an open-source library that routes requests to dozens of AI model providers, on October 21. For under two hours, version 1.107.0 on PyPI and several Docker image tags carried code that harvested SSH keys, cloud and deployment credentials, browser passwords and stored model-provider keys, plus a backdoor that checked in hourly for more instructions. The security firm SafeDep says the release went out through LiteLLM's own signed build pipeline, not a lookalike package. Anyone who installed that version should treat every credential on the machine as exposed.

Recursive, the self-improving AI startup led by former Salesforce chief scientist Richard Socher, released its first model on October 21. Flint is a 40 billion-parameter coding model that uses only 2.5 billion parameters at a time, small enough for a laptop, and its weights are on Hugging Face under the permissive Apache 2.0 license. Recursive says its automated research system, the Eureka Machine, contributed to nearly every stage, so a small team built Flint from scratch in under four months. In the company's own tests, Flint ran about 131 tokens per second on a MacBook Pro and led models under 50 billion parameters on SWE-bench Verified.

Meta said with its third-quarter results on October 21 that it will issue a new class of non-voting shares, trading from 2027, to fund AI spending, acquisitions and staff pay. It now expects capital spending of between 135 billion and 145 billion dollars this year. Mark Zuckerberg said Muse, the agent Meta launched in September, has more than 10 million users, about a quarter of whom use it daily, and that over a quarter of engaged users who shop through it average more than 200 dollars a purchase. He expects Muse to eventually earn more per user than Facebook and Instagram do, by taking a cut of the commerce it handles.