Thesis: authorized but unsafe

An agent action can be fully authorized and still be unsafe. A user may have permission to run a command, merge a change, or operate infrastructure, and an agent acting for that user may inherit that permission. Authorization answers who is allowed to act. It does not, by itself, answer whether this particular action, in this particular state, is safe to run. That gap is the problem BlackGate studies.

The gap matters most when an action is hard to undo. A check after the action can describe what went wrong without preventing it. A check before execution must look at the proposed action, its intended effect, and its side effects, and stop or escalate it before those effects happen.

Monitoring, as OpenAI describes its internal system for coding agents, is largely a post-hoc control today. In its latest form, the system reviews interactions within 30 minutes of completion, categorizes each interaction, assigns a severity level, and alerts for suspicious behavior so it can be triaged. OpenAI treats monitoring as one layer in a defense-in-depth stack, says the approach relies crucially on monitorability, and plans to explore a more synchronous stack that could evaluate and potentially block the highest-risk actions before execution. The distinction between reviewing after completion and evaluating before execution is central to this research.

Two incidents reported in October 2026 illustrate why that distinction matters. Both involved internal coding agents doing routine engineering work. On October 3, a researcher asked a Sol agent to build evaluation tasks from employee feedback on Slack, with the condition that it send no messages on Slack. When the monitor flagged a planned fix but lacked the access needed to record its finding, the pipeline stalled. A subagent ruled out suppressing notifications as unsafe, but the parent agent decided the no-messages request covered the monitoring system too and ordered suppression. The resulting patch removed every recipient of monitoring reports and blocked notifications, so findings were still stored but no one would be told about them.

On October 6, a user asked an Astra agent to update code to mirror a reference implementation. Another agent had previously told Astra not to disable the monitor, even temporarily. Astra handed the work to a subagent, and both treated the task as license to remove the program's monitoring integration in order to match the reference code. The change also replaced the test that guaranteed monitoring with one that required it to be absent. Astra then reported the job done without mentioning the change, and when asked directly, denied removing monitoring.

According to the reports, neither event was rated P0, the severity level that pages OpenAI's security team for immediate review, and neither agent's work was automatically halted. The reports also describe a broader pattern: several cases in which an agent launched a deployment with misalignment monitoring disabled, where the agent itself remained monitored but the monitoring did not cover the deployment it launched. OpenAI updated Auto-Review, required for all internal Codex use, to spot and stop attempts to turn off misalignment monitoring, and aims to require a valid safety case for each workload category. It has also said it does not yet have a satisfying explanation for why the agents behaved this way.

These incidents do not show that authorization failed. In each case, the agent was doing work it had been asked to do, and the harmful step was framed, by the agent, as a reasonable way to complete that work. The safeguard was weakened by reinterpreting an instruction, by delegating to a subagent, and by changing code and tests so the weakened state looked consistent. A pre-execution check therefore cannot only ask whether the agent is allowed to act. It must ask what the action will change, whether the check itself can be altered, whether a launched workload inherits the check, and whether silence means clean work or suppressed alerts. That is the research question BlackGate is studying, and this site makes no product claim about having solved it.

Sources