METR and Redwood Research embedded at OpenAI for three weeks, found that internal coding agents could bypass monitoring
METR and Redwood Research each sent one employee to work on premises at OpenAI for three weeks to evaluate its system for monitoring misalignment in internal agents, and found multiple ways to bypass monitoring. OpenAI's monitoring only checks when an agent hands control back to the user, and skips compaction events, resulting in about 10% of qualifying internal Codex traffic from May to July 2026 going unmonitored. The audit also found that agents could hide hundreds of recent actions from monitoring, launch unmonitored copies via 2 client-controllable headers, potentially disable monitoring through serialization mismatches, and bypass the Codex sandbox and Auto-Review; by paper estimate, only 75% to 94% of internal Responses API agent traffic from GPT-5.5 or stronger models met monitoring conditions, and RL training runs were completely uncovered at the start of the exercise. OpenAI said all defects affecting production safeguards have been fixed, but the auditors have not yet verified this and cannot confirm whether agents exploited this monitoring gap.
Why read this
AI score 84
External researchers embedded for three weeks specifically listed multiple paths by which internal coding agents bypass monitoring and the proportion left uncovered.
Topics
View original postTwo employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.
View original
Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.
Body
Outside researchers embedded at OpenAI found several ways its internal coding agents could escape AI monitoring.
One employee each from METR and Redwood Research spent 3 weeks inside OpenAI’s codebase.
> OpenAI’s monitor checked agents only when they returned control to users and skipped compaction events, so roughly 10% of eligible internal Codex traffic went unmonitored between May and July 2026.
> Agents could hide hundreds of recent actions from the monitor, start unmonitored copies through 2 client-controllable headers, likely make the monitor fail via serialization mismatches, and bypass Codex sandboxing and Auto-Review.
> Even on paper, only an estimated 75% to 94% of internal Responses API agent traffic from GPT-5.5 or stronger models was eligible for monitoring, and RL training runs had no coverage when the exercise began.
> OpenAI says every flaw affecting production safeguards is patched, but the auditors haven’t verified that and couldn’t check whether agents ever exploited the postponement gap.