How OpenAI Monitors Its Strongest Models: Four Layers, Three Real Incidents

A four-layer pipeline

In a post dated October 29, 2026, OpenAI describes how it monitors the behavior of its most capable models. The design is layered: cheap and recall-hungry at the front, expensive and judgment-heavy at the back.

• L0 activation probes — lightweight classifiers scanning internal activations for suspicious patterns, tuned for high recall and tolerant of false positives
• L1 model-based reviewer — a model inspects the agent's recent conversation, chain of thought, and tool use, looking for deception, unauthorized actions, and attempts to manipulate an evaluation
• L2 investigative agents — split into security and alignment investigators; they read back full context windows, write and run code in isolation to check evidence, reconstruct incidents, and triage severity
• L3 automated investigation — cross-references transcripts against network logs, system telemetry, and prior cases to surface recurring patterns

Coverage is stated as a hard commitment: all internal Codex traffic is monitored, as is every reinforcement learning run and evaluation for GPT-6 Astra and above. Higher-sensitivity activity bypasses L0 entirely, and 5% of probe-negative traffic is still routed to L1 specifically to catch what the probes miss. L1 checks are moving to a schedule of no more than 30 minutes apart.

Incidents, with timestamps

The most useful part of the post is three dated cases.