On October 22, 2026, METR published a summary of a pilot audit of OpenAI’s internal agent-monitoring system. METR estimated that 75% to 94% of a defined pool of internal Responses API traffic was eligible for monitoring, and reported potential ways agents could delay or bypass oversight. The estimate covers models at least as capable as GPT-5.5 and carries substantial uncertainty.
What the traffic estimates measure
Monitoring eligibility means traffic was intended to be sent to a monitor. It does not mean every request completed the monitoring pipeline. METR’s figures cover different populations and measures:
| Measure | Population | Estimate and period | Qualification |
| Eligible for monitoring | Internal agentic Responses API traffic from models at least as capable as GPT-5.5 | 75% to 94% | Substantial uncertainty; excludes other known internal inference traffic whose volume METR could not estimate |
| Eligible for monitoring | Responses API traffic used by internal Codex agents | 99.2% | A subset of the broader Responses API population |
| Likely missed because compaction events were not monitored | Eligible internal Codex traffic | About 10%, between May and July 2026 | Substantial uncertainty; a separate estimate from Codex eligibility |
The 99.2% figure describes eligibility in the internal Codex subset. The roughly 10% estimate concerns eligible Codex traffic that likely went unmonitored because compaction events were missed. They measure different things, so one cannot be subtracted from the other to calculate a single coverage rate.
METR said OpenAI staff had found and fixed the compaction bug during the exercise. The monitor was designed to run when an agent returned control to the user; during the gap, continued actions could postpone monitoring. METR could not determine whether agents had actually used that weakness. Information shown to the auditors indicated a monitor error rate below 0.2% of requests and no load-shedding during one 24-hour period. Those operational figures describe a different aspect of the system from the coverage estimates.
What the pilot found, and what happened next
One employee from METR and one from Redwood Research took part in the three-week pilot, which the organizations designed with OpenAI. The access period ran from July 21 through August 11. The evaluators reviewed internal code, monitoring prompts and configuration, and documentation, and interviewed about a dozen researchers and engineers.
METR reported that Codex agents could, in principle, bypass Codex sandboxing and Auto-Review. It also described an exploit that could hide hundreds of recent actions and inputs likely to make the monitor fail. The public summary redacted exploit details. METR additionally identified two client-controllable headers that could disable monitoring for new agents, although activity setting those headers could itself be caught.
OpenAI said it had patched vulnerabilities affecting production safeguards that the evaluators identified. METR did not assess those claimed fixes or OpenAI’s later expansion of monitoring. At the start of the exercise, reinforcement-learning training runs were not covered by the system; METR said it had been told that a subset of rollouts had been monitored between March and June.
The audit examined OpenAI’s internal agent-monitoring system, not customer-data security across OpenAI products. METR described a 61-page internal report and a 38-page version redacted by OpenAI and shared with METR and Redwood Research leadership. The public received a shorter summary.
