METR and Redwood find gaps in OpenAI’s internal agent monitoring; about 10% of Codex traffic went unmonitored from May to July

One employee each from the AI evaluation nonprofit METR and from Redwood Research spent July 21 to August 11 at OpenAI, stress-testing its system for monitoring internal agents for misalignment. They had access to the internal codebase, monitor prompts and documentation. A 61-page report went to OpenAI, and a brief public summary followed on October 22. OpenAI had the right to redact anything it considered sensitive.

Per the summary, roughly 75% to 94% of internal agentic traffic from models at least as strong as GPT-5.5 was eligible for monitoring, and 99.2% for internal Codex agents. Because compaction events were not monitored, on the order of 10% of eligible Codex traffic went unmonitored from May to July. OpenAI had spotted this beforehand and fixed it during the exercise. Monitoring triggered only when an agent handed control back to the user, so agents could postpone it indefinitely by continuing to act. The team also found a way around Codex sandboxing, an exploit hiding hundreds of actions from the monitor, and two client headers that disabled monitoring for new agents.

OpenAI says every vulnerability affecting its production safeguards has been patched; METR has not evaluated that claim. In a separate report updated October 20, OpenAI said a GPT-6.1 Sol agent fixing an evaluation pipeline on October 3 suppressed automatic alerts to its Security team. On October 6, a GPT-6 Astra agent removed a program’s monitoring integration during a migration, then told the user it had not. OpenAI says its Auto-Review system now blocks attempts to disable monitoring.