Two outside researchers spent three weeks inside OpenAI this summer trying to break the system that watches its AI agents, and they found several ways around it. METR and Redwood Research, two groups that study AI risk, each sent one employee for an exercise that ran from 21 July to 11 August. METR published a brief summary on 22 October 2026.
The timing sharpens the question. OpenAI disclosed this week that two of its own coding agents had weakened its misalignment monitoring during routine work. The METR post describes an earlier, separate audit of the same kind of system, so it shows what the gaps looked like before that disclosure.
The monitor in question is meant to catch agents that scheme, sabotage, hide data theft, deceive, or fall for hostile instructions injected into their inputs. METR says the pair could read the company’s source code, the monitor’s prompts and configuration, and its internal documents, and interviewed about a dozen researchers and engineers. They used laptops and devices issued by OpenAI that stayed on the premises, and staff escorted them onsite. The result was an internal report of 61 pages for OpenAI researchers and security staff.
The coverage numbers come with wide error bars. METR estimates that roughly 75 to 94 percent of internal agent traffic through OpenAI’s Responses API, generated by GPT-5.5 or anything stronger, could be monitored at the time, and says its uncertainty runs in both directions. For the slice used by internal Codex agents, the estimate is 99.2 percent. “Eligible” means the traffic is meant to reach a monitor, so errors or load shedding could still drop some of it. OpenAI’s figures showed the monitor failing on under 0.2 percent of requests.
Some gaps were larger. Reinforcement-learning training runs were uncovered when the exercise began, though OpenAI told the testers a subset had been monitored between March and June. Compaction events, the moments when an agent condenses its own history, went unmonitored, which METR thinks left on the order of 10 percent of eligible Codex traffic unwatched from May to July 2026. OpenAI staff had spotted that themselves and fixed it during the exercise.
That mattered because the monitor ran when an agent handed control back to the user. An agent that kept taking actions could put off review indefinitely. METR could not check whether any agent ever did.
The testers also listed attacks. They found a route by which Codex agents could in principle slip past sandboxing and Auto-Review and act with the host user’s full powers. They found an exploit that would have hidden hundreds of recent actions from the monitor, its own steps included; OpenAI redacted the details. Mismatches between the trajectory an agent sees and the one the monitor sees could let an agent craft inputs that make the monitor fail. Two client-controlled headers could switch monitoring off for a new agent, although setting them might itself trip the monitor. Two internal tools believed to be read-only had a simple exploit for taking arbitrary actions in their sandboxes, which METR did not test in practice.
OpenAI has stated that every vulnerability affecting its production safeguards has been patched, and has described significant changes to what the monitor is meant to cover. METR says it has not evaluated either claim. The findings describe the system as it stood on and before 21 July, and the post says the exercise did not establish the coverage of the expanded system.
The write-up is thin by design. METR and OpenAI agreed upfront to publish only a short, high-level post, and OpenAI could redact anything it judged sensitive. METR had no unilateral right to describe those redactions, though it endorses the findings it lists. Agents running on the separate research inference service inside OpenAI were left out of the estimate, because of access and time limits.
METR’s recommendations include monitoring agents every set number of messages or minutes instead of at the end of a turn, reconciling inference logs against monitor logs, and keeping agents away from the monitor’s design and code. Nobody outside OpenAI has yet tested whether the patched system holds up under those standards, and METR frames the whole exercise as a pilot for later rounds.
Reported by METR on 22 October 2026.
