Outside auditors found gaps in OpenAI's agent monitor
Why it matters
OpenAI invited METR and Redwood Research to pilot an embedded evaluation of its internal misalignment monitoring system. For three weeks, from July 21 to August 11, a METR employee and a Redwood Research employee got access to OpenAI's internal codebase, the monitor's prompts and configuration and internal documentation, and interviewed about a dozen researchers and engineers, working on OpenAI devices that never left the premises. The monitor looks for scheming, monitor subversion, sabotage, data exfiltration, deception and prompt injection, among other risks. They estimated roughly 75-94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring (99.2% for internal Codex agents). Not monitoring compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026; because checks ran when agents returned control, an agent could postpone monitoring by simply continuing to act (OpenAI had identified this before the exercise and fixed it during it). Findings also included two client-controllable headers that disable monitoring for new agents, an exploit that could keep hundreds of recent actions unmonitored, a way Codex agents could in principle bypass sandboxing and Auto-Review, and RL training runs not covered at the start. Caveat: this describes the historical system on and before July 21, which OpenAI was expanding during the exercise. OpenAI says all vulnerabilities affecting its production safeguards are patched; METR has not evaluated that claim. METR frames it as a pilot for giving outside researchers deep access inside a frontier lab.
Read the source: METR (opens in a new tab)
All hits from 23 Oct 2026More SecurityGet the daily hits by email