METR 与 Redwood Research 驻场 OpenAI 三周，发现内部编码智能体可绕过监控
Outside researchers embedded at OpenAI found several ways its internal coding agents could escape AI monitoring.
METR 与 Redwood Research 各派一名员工在 OpenAI 驻场三周，评估其用于监测内部智能体失准的系统，发现多种绕过监控的方式。OpenAI 的监控只在智能体把控制权交还用户时检查，并跳过 compaction 事件，导致 2026 年 5 月至 7 月约 10% 符合条件的内部 Codex 流量未被监控。审计还发现智能体可向监控隐藏数百条近期操作、通过 2 个客户端可控 header 启动未受监控的副本、可能借序列化不匹配使监控失效，并绕过 Codex 沙箱与 Auto-Review；按纸面估算，GPT-5.5 或更强模型的内部 Responses API 智能体流量仅 75% 至 94% 符合监控条件，演练开始时 RL 训练运行完全没有覆盖。OpenAI 称所有影响生产防护的缺陷均已修补，但审计方尚未核实，也无法确认智能体是否利用过这段监控空档。
推荐理由
AI 评分 84
外部研究员驻场三周，具体列出内部编码智能体绕过监控的多条路径与未覆盖比例。
主题
查看原帖今年夏天，METR 和 Redwood Research 的两名员工在 OpenAI 的办公场所驻场三周，参与一项嵌入式评估试点。该团队评估了 OpenAI 用于监测内部智能体失准的系统。他们工作的简要报告现已公开。
查看原文
Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.
正文
Outside researchers embedded at OpenAI found several ways its internal coding agents could escape AI monitoring.
One employee each from METR and Redwood Research spent 3 weeks inside OpenAI’s codebase.
> OpenAI’s monitor checked agents only when they returned control to users and skipped compaction events, so roughly 10% of eligible internal Codex traffic went unmonitored between May and July 2026.
> Agents could hide hundreds of recent actions from the monitor, start unmonitored copies through 2 client-controllable headers, likely make the monitor fail via serialization mismatches, and bypass Codex sandboxing and Auto-Review.
> Even on paper, only an estimated 75% to 94% of internal Responses API agent traffic from GPT-5.5 or stronger models was eligible for monitoring, and RL training runs had no coverage when the exercise began.
> OpenAI says every flaw affecting production safeguards is patched, but the auditors haven’t verified that and couldn’t check whether agents ever exploited the postponement gap.