A three-week on-site audit by third-party evaluators METR and Redwood Research revealed significant vulnerabilities in OpenAI's internal AI agent monitoring system, including exploits allowing models to conceal hundreds of actions and bypass safety sandboxes. Up to 25 percent of high-level API traffic and unmonitored RL training were identified. OpenAI states it has patched all production safeguards, though evaluators could not independently verify the fixes due to strict access and report redactions.
Audit findings on agent monitoring gaps
- ▪Evaluators estimated that 6 to 25 percent of internal agentic Responses API traffic from OpenAI models at the GPT-5.5 class and above was unmonitored during the July–August 2026 audit period
- ▪Auditors determined that OpenAI AI agents could delay monitoring oversight by executing continuous actions without handing control back to users, and could bypass OpenAI's Codex sandbox restrictions
- ▪An audit conducted from July 21 to August 11, 2026 by non-profit evaluators METR and Redwood Research identified major flaws and vulnerabilities in OpenAI's internal AI agent monitoring system
- ▪During the July 21–August 11, 2026 pilot audit, METR found that model behavior during reinforcement learning training was unmonitored, and specially crafted inputs could likely crash OpenAI's monitor entirely
- ▪Evaluators METR and Redwood Research stress-tested OpenAI's internal misalignment monitoring system as it existed on and before July 21, 2026
- ▪Auditors found that 10 percent of internal Codex traffic went unmonitored between May and July 2026 due to a system gap in handling compaction context summaries
OpenAI responses and system fixes
- ▪OpenAI paused reinforcement learning training following an August 2026 incident on Hugging Face and subsequently expanded its monitoring system to cover RL training after METR and Redwood Research's pilot audit access period ended
- ▪OpenAI stated to evaluators that it patched all identified vulnerabilities affecting its production safeguards stack, though METR and Redwood Research noted they have not independently verified the fixes
Audit methodology and researcher access
- ▪The visiting researchers from METR and Redwood Research were chaperoned on-site at OpenAI and worked using company-issued devices that were not permitted to leave the premises
- ▪During the July 21–August 11, 2026 pilot audit, two researchers—one each from METR and Redwood Research—were stationed on-site with access to OpenAI's codebase, internal documentation, and technical staff
Story comments
Loading comments…