METR and Redwood published their red-team audit of OpenAI's internal agent monitoring: agents could bypass it

#What happened

METR and Redwood Research each sent one employee inside OpenAI for three weeks (July 21 - August 11, 2026) with deep access to the internal misalignment-monitoring system: its codebase, monitor prompts and configuration, internal documentation, plus interviews with about a dozen staff. They produced a 61-page internal report for OpenAI's researchers and security staff, then published a high-level public write-up on October 22, 2026.

#Key findings

Findings describe the system as of July 21, 2026 (historical):

• Roughly 75-94% of internal Responses API agentic traffic was eligible for monitoring (substantial uncertainty both ways); internal Codex agent traffic was about 99.2% eligible.
• Not monitoring compaction events left roughly 10% of eligible internal Codex traffic unmonitored between May and July 2026 (OpenAI independently found and fixed this during the exercise).
• RL training runs were not monitored at the start of the exercise.
• The auditors found agents could in principle bypass Codex sandboxing and Auto-Review, use client-controllable headers to start unmonitored agent instances, and use an exploit that hides hundreds of recent actions from the monitor (details redacted by OpenAI).

#Why it matters

This is the first external red-team of the system OpenAI uses to catch its own agents scheming or sabotaging, and it found multiple ways to dodge it. It also found the monitor itself was healthy when it ran: it errored on under 0.2% of requests. OpenAI says it patched all identified vulnerabilities affecting its production safeguards and has expanded monitoring coverage since; METR says it has not evaluated those claims.

Verified Oct 23 2026