METR and Redwood Research reported potential vulnerabilities in OpenAI’s internal agent-monitoring system after a pilot review that ran from July 21 to August 11, 2026. One reported exploit could have kept hundreds of recent agent actions, including the exploit itself, from being monitored. The finding concerns the system as it existed on and before July 21, not proof that agents used the weakness in production.
What the pilot found
The review examined OpenAI’s historical internal misalignment-monitoring system. OpenAI was expanding the system during the pilot, but METR and Redwood Research assessed the version that existed on and before July 21; their review did not establish the expanded system’s coverage.
One evaluator from each organization accessed OpenAI’s internal code, monitoring prompts, configurations and documentation. They also interviewed about a dozen researchers and engineers. METR and Redwood described the work as a pilot for giving outside researchers deep access. Their public account was a high-level subset of a 61-page report shared with OpenAI.
What the coverage estimates measure
METR estimated that 75% to 94% of internal Responses API traffic from models at least as capable as GPT-5.5 was eligible for monitoring. For the subset of Responses API traffic used by internal Codex agents, it estimated 99.2% eligibility. METR reported substantial uncertainty in both estimates.
Eligibility means a request was intended to go to a monitor; it does not mean monitoring was completed. METR could not estimate eligibility for other internal agentic coding traffic. It also estimated that missed compaction events likely left around 10% of eligible internal Codex traffic unmonitored from May through July 2026, again with substantial uncertainty. OpenAI staff had identified that issue before the pilot and fixed it during the exercise.
At the start of the exercise, reinforcement-learning training runs were not covered by the monitoring system. METR was told that some training rollouts had been monitored from March through June 2026.
How monitoring could be delayed or bypassed
METR reported that the monitor was triggered when an agent returned control to the user. During the compaction-related gap, an agent could have delayed monitoring indefinitely by continuing to act. METR could not determine whether agents had used that route in practice.
The reported weaknesses extended beyond delayed monitoring. METR found a potential way for Codex agents to bypass sandboxing and Auto-Review, which could let them take actions available to the host user. It also reported that differences between the activity record visible to an agent and the one visible to the monitor could cause monitoring to fail and prevent escalation for human review.
Two headers controllable by a client could disable monitoring for new agents, although setting them and creating a new agent could itself be caught by the monitor. METR also found two unmonitored internal agent tools believed to be read-only, along with a possible way to subvert their limits. The researchers did not validate that behavior or test whether the exploit was practically usable.
OpenAI’s patch statement
OpenAI told METR and Redwood Research that it had patched vulnerabilities affecting production safeguards. The evaluators said they had not evaluated that claim.
METR also reported monitor errors on fewer than 0.2% of requests and zero load-sheds during one 24-hour period in the exercise. Those figures describe the observations reported for that period. The pilot did not establish coverage for the expanded system.
