# OpenAI: activation probes can halt a reply and block tool calls

> OpenAI says probes that read internal activations now score every completion from GPT-5.6 and can block a tool call before it runs.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Lab safety
- **Published by:** OpenAI
- **Disclosed:** 2026-11-02
- **Affects:** GPT-5.6 Sol, GPT-5.6 Terra
- **Research by:** Alex Makelov, Xiaojun Xu, Sundaram Ananthanarayanan, Ethan Mcdonald, Tom Dupre la Tour
- **Primary source:** https://alignment.openai.com/training-activation-classifiers/
- **Page:** https://theinjection.dev/items/openai-activation-classifier-probes/

OpenAI says it has run activation classifiers, or probes, on every assistant completion since GPT-5.6, reading internal activations to stop a reply mid-stream and hold tool calls until a reasoning model clears them.

## What happened

OpenAI's alignment team described the system in a post on November 2, 2026, written by Alex Makelov, Xiaojun Xu, Sundaram Ananthanarayanan, Ethan Mcdonald and Tom Dupre la Tour. OpenAI states that activation classifiers run on all assistant completions starting from GPT-5.6, on internal and external traffic. The GPT-5.6 system card says Sol and Terra are served with the newly added classifiers, focused on sensitive domains.

## How it works

A probe is a small supervised classifier trained on the model's own activations rather than on its text, and it scores the output token by token while the reply streams. When a probe fires, OpenAI says serving stops streaming the completion, escalates the message to a reasoning model for a final judgement, and blocks any tool call until that call is marked safe. OpenAI reports that the random initialization accounts for about 85% of the variance in probe performance, so it trains at least 32 initializations per configuration, on up to 1 million messages and fewer than 5 epochs.

## Who is affected

Callers of OpenAI's most capable models meet this layer, with GPT-5.6 Sol and GPT-5.6 Terra named in the system card. Agents that make tool calls are the ones that can see a call held while the reasoning model decides. OpenAI says probes transfer well across post-training checkpoints but less well across pre-training ones, so each new base model needs its own training run.

## What to do

Expect a completion or a tool call to be interrupted by a safety layer you cannot inspect, and handle that case in agent code instead of treating a halted stream as a transport error. Do not read the probes as a replacement for your own controls: OpenAI states they detect only what they were trained to detect and are meant to sit alongside its other safeguards.

## Quick facts

- **Deployed on:** All assistant completions from GPT-5.6, per OpenAI; the system card names Sol and Terra
- **What it reads:** The model's internal activations, scored token by token during generation
- **On a hit:** Streaming stops, a reasoning model makes the final judgement, and tool calls are held until marked safe
- **Claimed benefit:** More robust to jailbreaks than OpenAI's content-based classifiers in its own red-teaming
- **Stated limits:** Detects only what it was trained to detect, and needs retraining for each new base model
- **Published:** November 2, 2026

## Questions

### Can an activation probe stop a tool call my agent makes against GPT-5.6?

Yes, by OpenAI's description. When a probe fires, serving stops streaming the completion, escalates the message to a reasoning model for a final judgement, and blocks the tool call until that call is marked safe. OpenAI presents the probes as one layer among several safeguards rather than a replacement for the others.

### Are activation probes better than text classifiers against jailbreaks?

OpenAI claims probes are overall more robust to jailbreaks than its content-based classifiers, based on its own red-teaming, and especially robust to jailbreaks that were not optimized against the probe directly. OpenAI also warns that real attacks adapt to signals from the safety stack, so that margin is not a fixed property of the method.

### What are the stated limits of OpenAI's activation probes?

Probes are trained with supervision, so OpenAI says they detect only what they were trained to detect. They need retraining for each new base model and may need it as weights change, and they transfer less well across pre-training checkpoints than across post-training ones. The published figures come from internal experiments.

## Sources

1. [Activation Classifiers](https://alignment.openai.com/training-activation-classifiers/)
2. [GPT-5.6 Red Teaming](https://deploymentsafety.openai.com/gpt-5-6/automated-red-teaming-for-jailbreaks)