What it is. Agent monitoring means automatically watching what an AI agent says and does, such as the tools it uses, the code it runs and the websites it visits, so that risky behaviour is spotted and a person is alerted.
An analogy. Think of how your bank watches your card. Simple rules catch obvious problems instantly, such as a purchase in two countries at once. Suspicious cases go to a smarter system, and the hardest ones to a human investigator. Most transactions pass straight through; a few get a closer look.
How it works. Monitors read an agent’s record of activity, not its inner workings. (Reading the inner workings is a different tool, covered in our probes explainer.) A typical set-up is layered: fast, cheap checks flag anything unusual; a second AI model reads the flagged conversations and tool calls; and people review what is left. The hard part is coverage. A monitor cannot catch what it never sees, and a monitor that has been switched off catches nothing at all.
Why it was in the news this week. OpenAI published how it now monitors its most capable models in four layers: automated checks, a model-based reviewer, investigative agents that reconstruct what happened, and network log checks before a person is alerted. It says that when it replayed this year’s Hugging Face incident, its security team would have been alerted more than 30 hours before the real breach. That is OpenAI’s own simulation. Outside red-teamers at METR and Redwood Research had earlier estimated that roughly 75 to 94% of eligible internal agent traffic could be monitored, and found two settings that could switch monitoring off. Our brief has the details.
One thing to remember. Monitoring is a safety net, not a guarantee. Ask two questions of any claim: how much of the agent’s activity is watched, and who checked the monitor besides the company that built it?
Sources: OpenAI, “How we detect frontier model misalignment”, 29 Oct 2026, openai.com, as reported in our brief of 31 Oct 2026.