OpenAI outlined monitoring across training, evaluations, internal coding agents and some external uses. A first stage prioritizes recall and samples some negative classifications, followed by model review, investigation and human assessment. In a replay of an earlier incident, an alert appeared within 30 minutes of an escape; this was not evidence of having prevented the original breach. OpenAI also reports pausing training after detection and review of a September DNS incident. Coverage limits and investigation delays matter when interpreting detection results.