OpenAI describes 'probes' that watch a model's inner activity to catch bad behavior

In short

OpenAI says it now runs small monitoring tools called "probes" on its most capable models, starting with GPT-5.6. The probes read the model's internal activity as it writes an answer and flag possible rule-breaking or misaligned behaviour. OpenAI says probes are an extra layer of protection and do not replace its other safeguards.

What happened

In a post on its Alignment Research Blog dated 2 November 2026, five OpenAI researchers described how the company builds and uses these probes. This is a description of a safety method, not a report about a specific incident.

OpenAI says it already uses text classifiers, which are programs that read a user's request and the model's reply and sort them into categories such as "allowed" or "against policy." Starting with GPT-5.6, it has added activation classifiers, or probes. Activations are the model's internal number patterns as it processes text. OpenAI calls them the model's "neural patterns." A probe is a small program trained to spot patterns linked to misaligned or otherwise unwanted activity, such as a user with harmful intent.

According to OpenAI, probes check a reply word by word as it is written. If a probe's score passes a set level, the system:

• stops showing the reply to the user,
• sends the message to a reasoning model, which is a model built to work through problems step by step, for a final decision,
• blocks any tool calls until they are marked safe. Tool calls are actions the model takes, such as running code or searching.

OpenAI says the probes run on both internal and external traffic of its most capable models. They are one part of a wider monitoring system that also includes model-based review, automated investigation and human response.

OpenAI reports that in its tests, probes held up better against jailbreaks than its text-based classifiers. Jailbreaks are tricks people use to get a model to ignore its rules. OpenAI also says probes tend to work better on more capable models. It adds that the figures in the post come from various internal experiments and are not necessarily representative of the classifiers actually in use.

What was done about it

OpenAI says it is training better probes and widening the set of policies they cover. It names several limits. Probes can only detect kinds of behaviour they have been specifically trained to detect, using labelled examples. A probe built for one model does not work on a new base model and must be retrained. Probe accuracy can also drop as a model is updated over time, so OpenAI says periodic retraining is needed. The company also notes that real attackers can adapt to its safety systems, which is why it runs automated and manual red-teaming, meaning deliberate attempts to break its own safeguards.

Why it matters

OpenAI says that despite progress in training models to behave safely, there are still cases where pressure from users, rare situations or training failures can weaken that behaviour. It describes probes as part of a "defense in depth" approach, where several separate safeguards are layered so that one can catch what another misses. OpenAI says probes have become an integral part of its safety and alignment strategy, while also stating that they cannot catch problems they were not trained to recognise.

More detail is in the original report.