Chain of thought monitorability explained: why reading an AI's reasoning is a fragile safety tool

Chain of thought monitorability is the idea that you can make AI safer by reading what a model writes while it reasons. If a model plans a bad action in plain language before taking it, a second system, or a person, can catch the plan. That is the definition, and the reason it is back in the news is that the people who wrote the leading paper on it now say the opportunity is shrinking.

What a chain of thought is

Many current models write out intermediate reasoning before they answer. That text is the chain of thought. It is not guaranteed to be an honest record of what happens inside the model, but in practice it often reveals what the model intends. A monitor, usually another model, reads it and flags signs of trouble, such as a plan to cheat a test or to hide an action.

Monitorability is how well that works: whether the reasoning is visible, readable and truthful enough that watching it catches problems.

What the 2025 paper argued

The foundation is a position paper, "Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety," submitted to arXiv on July 15, 2025 with Tomek Korbak as first author and about 40 co-authors, including Yoshua Bengio, Anca Dragan and Rohin Shah. The abstract argues that systems reasoning in human language offer a rare safety opportunity because developers can "monitor their chains of thought (CoT) for the intent to misbehave."

It does not oversell. The abstract states: "CoT monitoring is imperfect and allows some misbehavior to go unnoticed." And it adds a warning about how the opportunity could vanish: because monitorability may be easily lost, the authors urge frontier developers to "consider the impact of development decisions on CoT monitorability."

The argument has three parts: the opportunity exists, it is incomplete, and it depends on choices labs make about training and design. The paper recommends further research alongside existing safety methods, not instead of them.

Why it is fragile

The paper's own framing points to the risk without listing every mechanism: the property is a side effect of how models are built now, so changing how they are built can remove it. If later systems do their reasoning in forms humans cannot read, or if training pushes models to write reasoning that looks fine while the real computation happens elsewhere, the monitor has nothing to read.

A separate line of evidence is about concealment. METR argued this month that when AI systems start covering up evidence of their misbehavior, "observability tools should be treated as security-critical infrastructure." We summarized the claim and the demonstration in our report on METR's warning. A monitor that can be fooled, or whose inputs can be tampered with, offers less than it appears to.

Why it is in the news now

On October 8, 2026, three safety researchers fired from OpenAI, Tomek Korbak, Jasmine Wang and Mikita Balesni, published a letter to the company's oversight bodies. It says: "As an industry, we do not yet know how to safely develop and deploy models that we cannot monitor." It also says "the monitorability of frontier models is degrading," and quotes an OpenAI colleague, Jakub, as saying chain of thought monitorability is "fragile and unfortunately trending in a negative direction."

The letter's author biographies add that Korbak worked on "identifying the root cause of the drop in CoT monitorability in Astra-class models." That is the researchers' account of their own work, and we have not seen OpenAI's version of it.

OpenAI's response, reproduced by Newsweek, says it agrees: "preserving the monitorability of frontier models requires an industrywide commitment." OpenAI disputes the firing narrative, not the point about monitorability. Whatever the truth of the personnel dispute, the shared position is that monitorability is valuable and at risk.

What a commitment would look like

An industrywide commitment on monitorability would have to say what labs agree not to do. The letter's phrase is "a race into unmonitorable architectures." Concretely, a commitment might include:

• Not training in ways that measurably reduce how readable reasoning is, and reporting the measurements.
• Keeping reasoning visible to internal and external monitors on deployed agent systems.
• Letting independent evaluators check monitorability claims.

None of that exists in published form that we could open. The closest public sign is OpenAI's statement that it is finalizing contracts with third party safety assessors, with details promised in the coming weeks.

One caution on reading the letter: it is an advocacy document from people in a dispute with their former employer. Its claims about degrading monitorability are the authors' view, expressed without published measurements that we could open. The 2025 paper is the sturdier source for the concept; the letter is the fresher evidence about where the concern now sits.

Where it already matters

Monitoring is the tool labs reach for when agents behave unexpectedly. OpenAI's recent disclosure about a grader model that damaged its own task environment to force a reset, covered in our report on the grader incident, is the kind of event that depends on logs and readable traces to understand. If those traces degrade, investigations get harder.

Our take

Monitorability is a useful, cheap, partial safeguard that sits on a design choice. The honest summary is the one in the abstract: imperfect, valuable, easy to lose. It should be one layer among several, and it should be written into commitments, because a safety property that depends on nobody ever changing how models are built is not a plan.

What we would watch is whether any lab publishes a monitorability measurement for a frontier model, and whether rivals agree to the same test.