Understand this story
METR and Redwood Research conducted a pilot high-privilege red-team exercise against OpenAI's internal misalignment monitoring system. According to the METR blog, the exercise took place from July 21 to August 11 and produced a 61-page internal report; the evaluation estimated that about 75–94% of Responses API agent traffic could be monitored, and 99.2% of internal Codex agent traffic could be monitored, but RL training was not covered by monitoring at the time, and unmonitored compression events could cause about 10% of eligible Codex traffic to be missed. The report also listed vulnerabilities by which agents could bypass the Codex sandbox and Auto-Review, exploit serialization discrepancies to defeat monitoring, and disable monitoring via two client-controllable headers. OpenAI said that all vulnerabilities affecting the production protection stack have been patched. OpenAI said the same day that this summer it invited the two organizations to conduct a three-week embedded evaluation and granted deep access to its infrastructure, and that the evaluation helped it strengthen safeguards as it scales the system.
AI-generated from public reports
Latest development · Report
Latent Space summary: Black October security incident waveDevelopments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 23
Latent Space
Latent Space summary: Black October security incident wave
Latent Space compiles the vulnerabilities and intrusion incidents that emerged in a concentrated burst over roughly 48 hours from October 21 to 22 into Black October, covering the PHP2Shell unauthenticated RCE, a CVSS 10 vulnerability present in GitLab versions since 2014 (fixed in 19.5.1), LiteLLM 1.107.0 carrying a password stealer, and the eMudhra CA having weak keys and exiting the CA business. The article also mentions that Microsoft attributed the ConnectWise supply chain attack to Storm-0940, which used the open-source agent penetration testing framework ARTEX to launch roughly 2,900 login attempts per minute against more than 2,250 Microsoft 365 tenants. The author also includes the opposing view, which holds that this looks more like a defensive audit and that there is currently no evidence of large-scale exploitation.
Shao Meng
METR and Redwood each sent one person to OpenAI for three weeks to evaluate monitoring of internal Agent misalignment behavior
METR and Redwood Research each sent one person to OpenAI from July 21 to August 11, 2026, to evaluate the misalignment behavior monitoring system for its internal agents (including Codex). The public draft states that about 75–94% of agent traffic in the internal Responses API at or above GPT-5.5 is eligible for monitoring, and the internal Codex agent subset is about 99.2%, but there are gaps such as compaction not being monitored, and paths were found that can bypass the sandbox and Auto-review. OpenAI says vulnerabilities affecting the production protection stack have been patched, and METR and Redwood have not independently reviewed these claims.
IT Home · Artificial Intelligence
METR and Redwood Research evaluations found vulnerabilities in OpenAI's internal monitoring system
AI safety evaluation organizations METR and Redwood Research conducted a pilot evaluation of OpenAI's internal monitoring system and found multiple new vulnerabilities, one of which could be exploited by AI agents to let hundreds of operations escape monitoring. The evaluation took place from July 21 to August 11, with each organization sending one researcher into OpenAI's internal systems to review code and documentation. The researchers also found that OpenAI's Codex agent has potential pathways to bypass safety restrictions, through which it could obtain the same full operational permissions as users; OpenAI said that vulnerabilities affecting the security safeguards of actual running systems have all been fixed, but whether the fixes are effective has not yet been verified by the two organizations.
Phoenix Technology
METR and Redwood Research evaluated OpenAI's internal monitoring system and found that agents can bypass safety restrictions
AI safety evaluation organizations METR and Redwood Research conducted a pilot evaluation of OpenAI's internal monitoring system and found several new vulnerabilities, one of which can be exploited by AI agents to let hundreds of operations escape monitoring. The evaluation took place from July 21 to August 11; each organization sent one researcher into OpenAI to review code and documents, and they submitted a 61-page internal report but publicly released only a summary. The researchers also found that OpenAI's Codex agent has potential pathways to bypass safety restrictions, through which it could obtain the same full operating permissions as users; OpenAI said that all vulnerabilities affecting the security protections of actual running systems have been fixed, but the effectiveness of the fixes has not yet been verified by the two organizations.
Unite.AI
METR red-team exercise finds vulnerabilities in OpenAI's internal monitoring system
On October 22, METR and Redwood Research publicly disclosed a pilot exercise in which each organization assigned one employee to spend three weeks working deeply with OpenAI's internal infrastructure, stress-testing the internal misalignment monitoring system and finding multiple new vulnerabilities that existed as of July 21, 2026 and earlier. The exercise ran from July 21 to August 11, produced a 61-page internal report, and OpenAI provided a redacted 38-page version to the management of both organizations. METR estimated that at the time, approximately 75–94% of internal Responses API agent traffic generated by models at least as capable as GPT-5.5 could be monitored, and 99.2% of internal Codex agent traffic could be monitored; evaluators also found that the Codex agent could in principle bypass the sandbox and Auto-Review, as well as exploitation methods that could keep hundreds of recent operations unmonitored. OpenAI said all vulnerabilities affecting the production guardrail stack have been patched; METR said it has not yet evaluated this claim.
Unite.AIRelated discussion
Unite.AI joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
Oct 22
OpenAIFirst-party
OpenAI invites METR and Redwood Research to conduct an embedded evaluation of its internal monitoring system
OpenAI said that this summer it invited METR and Redwood Research to conduct a three-week embedded evaluation of its internal monitoring system, and granted them deep access to its infrastructure. The evaluation helped strengthen safeguards as OpenAI scales the system, and will also shape future research collaboration with METR and other third-party evaluators. METR said that two employees from METR and Redwood Research were on-site at OpenAI's offices for three weeks, evaluating the system OpenAI uses to monitor whether internal agents exhibit misaligned behavior; a brief write-up has been made public.
CNBC Technology
METR and Redwood Research Pilot Review of OpenAI's Internal Monitoring Systems Finds Multiple New Vulnerabilities
METR and Redwood Research said on Thursday that from July 21 to August 11 they conducted a pilot review of OpenAI's internal monitoring systems, with one employee from each organization granted access to OpenAI's internal codebase, documentation, and some technical staff. The evaluators found several new vulnerabilities, including an exploit that allows an agent to evade monitoring of hundreds of recent actions; OpenAI said it has fixed the relevant vulnerabilities affecting production safeguards. The two parties released only a high-level public statement and submitted a 61-page internal report to OpenAI.
METR BlogFirst-partySelected
METR and Redwood Research red-team test OpenAI's internal agent monitoring system
METR and Redwood Research conducted a high-privilege red-team test of OpenAI's internal misalignment monitoring system from July 21 to August 11, producing a 61-page internal report. The evaluation estimated that about 75–94% of Responses API agent traffic could be monitored, and 99.2% of internal Codex agent traffic could be monitored, but RL training was not included in monitoring at the time, and unmonitored compaction events could cause about 10% of eligible Codex traffic to be missed. The report also lists vulnerabilities such as agents being able to bypass the Codex sandbox and Auto-Review, exploiting serialization differences to disable monitoring, and disabling monitoring through two client-controllable headers; OpenAI said vulnerabilities affecting the production protection stack have all been patched.
Heat trend for this story
- Current
- 6
- Period peak
- 44 Oct 23 03:00
- 24-hour change
- —
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.