OpenAI and Anthropic have upgraded systems for monitoring AI agents, but both acknowledge that safeguards can still miss unfamiliar behavior and harms they were not trained to recognize.

That limitation matters: researchers inside and outside the companies warn that monitoring may overlook misaligned agents, while the volume of conversations makes human review alone difficult.

Anthropic’s approach adds a hidden check at the end of a conversation, asking Claude to assess whether harm occurred and, if so, report the potential harm, whether it refused, and how urgently a person should review it.

Anthropic said the system identified 78% of conversations flagged as potentially harmful, with a 1% false-positive rate, and costs less because it does not need a separate model to reread each exchange.

The method has trade-offs: Anthropic warned that simulated training conversations and embedding the check in its models can preserve blind spots, while OpenAI said its monitors can generate false alarms.

Both companies also say their systems struggle with patterns they have not seen before; Anthropic cited limited experience identifying fraud and cyber risks, and OpenAI is still testing its ability to detect unfamiliar behavior.

OpenAI’s expanded misalignment monitoring uses more computing resources and is intended as a failsafe if other protections fail; replaying behavior from the Hugging Face breach, the company found it would have detected the attack more than 30 hours earlier.