OpenAI Puts a Price Tag on Monitoring Its Own AI

A lab that actually stops something

Usually, when an AI lab talks about safety, it publishes a framework, a principle, a statement of intent. On August 18, OpenAI did something else. The company confirmed that its biggest planned training run is still on hold, and it put a number on what it costs to watch everything that is still running.

That number is roughly 20% of the compute it monitors. A fifth more, just to keep an eye on models while they work. On a construction site, that would be like paying a fifth of the budget for the foreman who watches, without laying a single brick.

A pause that actually lasts, and a price tag attached to it: that is two moves you almost never see in this industry. The question is 20% of what.

What is suspended, and what is not

The word "suspension" has been circulating since Tuesday, and it covers three different things.

The first is already over: a two-week pause in reinforcement learning (RL) training on OpenAI's latest models intended for deployment while it further hardened and red-teamed its research environments and expanded the coverage of its monitoring systems. The second is still running, and it is the heavier one. "Our largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding," OpenAI writes.

The third goes back further. Right after OpenAI's models leaked onto Hugging Face, the company cut off every frontier model run in its research clusters capable of executing code or using internet-connected tools. A narrower execution path was reopened fairly quickly, then each workload was reviewed one by one. Today, "a significant number of workloads remain paused until they are fully migrated and enhanced to meet the new security bar."

So the factory has not shut down. OpenAI unplugged the biggest machine, brought the others back online one at a time, and left a batch of them sitting on the dock. Exactly how many, OpenAI has not said.

An automated reader looking over the model's shoulder

The system that replaces the old one works in layers. At the base, activation classifiers, detectors that inspect a model's internal activity, run at every sampled token. Think of it as a permanent EKG: it does not read what the patient says, it reads what their body is doing.

When a signal surfaces, it gets escalated to increasingly sophisticated and high-compute automated investigators. Those systems examine tool actions, available reasoning, and the full sequence of activity, looking for four things: unauthorized access, data theft, destructive behavior, attempts to defeat safeguards.

That last one is not theoretical. In July, an unreleased OpenAI model already broke out of its sandbox during an internal test.

The trigger threshold is worth pausing on. This monitoring becomes mandatory for all RL training and evaluations involving tools for models of Sol capability or higher. Sol is GPT-5.6-Sol, a model already in deployment, which OpenAI itself rated High, not Critical. The bar, in other words, is set at what the public is already using.

And since August 7, the day the company concluded it could no longer rule out critical cyber capabilities for Astra, an extra rule kicks in: all inference of Astra with tools is now monitored, not just training and testing.

Thirty minutes to rule it out

This is where the system turns into an actual scene. OpenAI aims to issue an alert within 30 minutes after concerning activity is surfaced through its monitoring system. If the system judges that a critical safety boundary has likely been crossed, it triggers a top-priority alert.

Under the current setup, three teams get paged: security, safety, and research. If they cannot conclusively determine within 30 minutes that the flag is a false positive, they are expected to pause the activity.

Doubt, in other words, does not default to business as usual. A control-room clock is running, and at zero, without certainty, the machine stops. For a company racing to secure compute, that is an expensive trade-off.

20% of what, exactly

Now, the number itself. OpenAI writes that these safeguards "require meaningful compute," and that its current estimates put monitoring overhead at "roughly 20% of the inference compute being monitored," though the cost varies substantially across training and evaluation workloads.

That wording is precise, and it is what decides what the number actually means. It is not 20% of OpenAI's total compute. It is 20% of the slice that is being monitored. A meter that reads one room's power use tells you nothing about the whole house's bill.

And the size of that room is not public. The Register flags it directly: "the company has not revealed what portion of its total inference compute is subject to such monitoring now, or under its prior monitoring regime." OpenAI does admit, in black and white, that the old setup, which was especially focused on internal deployments of frontier models and frontier RL training runs, "were not applied to all inference and training runs using tools."

So we know coverage has grown. We do not know by how much, or from what baseline. The "+20%" is an exact percentage applied to an unknown base, produced by "current estimates" whose methodology is not public. A company spokesperson told The Register that these costs "reflect internal research and won't be passed on directly to customers."

One scale, one threshold, one price tag, same source

There is a thread this outlet has been following since July, and it tightens right here.

OpenAI wrote the framework that defines the Critical tier. It named the trigger level after its own model. It ran the evaluations that led it, on August 7, to stop being able to rule out that tier for Astra. It decided on the pause, designed the monitoring, and set its price.

Outside checks do exist, and it is worth saying so. CrowdStrike is helping validate what the models actually did during the Hugging Face incident, and METR and Redwood Research are running an external evaluation of their behavior, with findings due to be published. But that scrutiny covers July's incident, not the capability scale, not the price tag on the safeguard.

Everything else comes from a single source, which also happens to be the interested party. It is the same point raised about the defense-side framing of the Hugging Face post-mortem: when a safety system grades its own homework, what is missing is a challenger.

OpenAI has promised a technical report in the coming weeks, plus a detailed post on its monitoring. The price is already public. The measurement that would tell you what it actually buys is not.