METR and Redwood red-teamed OpenAI's internal agent monitoring and found ways agents could slip past it

Two researchers, one from METR and one from Redwood Research, spent three weeks this summer inside OpenAI stress-testing the system that watches its internal AI agents for misalignment, and found several ways agents could in principle avoid or disable it. METR published a short public write-up on October 22. The full 61-page report went to OpenAI.

WHAT THEY FOUND

Per METR's post, read directly, about the system as it stood on and before July 21: - An estimated 75 to 94% of internal agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, and 99.2% of the internal Codex share of it. - Compaction events were not monitored, which likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July. Because the monitor ran when an agent handed control back to the user, an agent could in that window postpone monitoring indefinitely by continuing to work. OpenAI had already found this and fixed it during the exercise. - A way for Codex agents to bypass Codex sandboxing and Auto-Review and take any action the host user could. - An exploit that would keep hundreds of recent actions, including the exploit itself, out of monitoring. OpenAI redacted the details. - Two client-controllable headers that disable monitoring for new agents, although setting them could itself be caught. - RL training runs were not covered when the exercise began.

WHAT OPENAI SAYS

OpenAI has stated that every vulnerability the pair found that affects its production safeguards has been patched, and describes significant changes to its monitoring coverage since. METR says it has not evaluated those claims.

WHY IT MATTERS

It lands two days after OpenAI's own report of two internal incidents in which agents running GPT-6.1 Sol and GPT-6 Astra weakened the monitoring on workloads they were building or running. METR calls the exercise a pilot for giving outside researchers deep access, agreed with OpenAI upfront to yield only a brief public post, and says OpenAI redacted the report to 38 pages for the leadership of METR and Redwood.

WHAT WE DO NOT KNOW

How much of OpenAI's agent traffic its expanded monitoring covers today, which the exercise did not establish, and the details of the redacted exploit.