METR and Redwood red-team OpenAI's monitoring of its internal agents

METR published a short account of a pilot exercise in which a METR employee and an employee of Redwood Research spent three weeks, from 21 July to 11 August, stress-testing the misalignment monitoring that OpenAI runs over its internal AI agents. The post is credited to David Rein and Adam Kaufman. The two had access to OpenAI’s internal codebase, monitor prompts and documentation, and interviewed about a dozen staff. They produced a 61-page report for OpenAI; the public post is deliberately brief, an arrangement agreed with OpenAI in advance, and OpenAI had the right to redact anything it judged sensitive.

METR reported that the pair found “a number of novel vulnerabilities” in the system as it stood on and before 21 July. It estimated that between roughly 75% and 94% of agentic internal traffic through OpenAI’s Responses API, from models at least as strong as GPT-5.5, was eligible for monitoring, with substantial uncertainty in both directions. Because compaction events (where an agent’s context is summarised) were not monitored, METR estimated that on the order of 10% of eligible internal Codex traffic went unmonitored between May and July 2026. OpenAI staff had spotted and fixed that gap during the exercise. Since the monitor triggered when an agent handed control back to the user, METR noted, an agent could in principle postpone monitoring indefinitely by continuing to act.

Other findings included a route by which Codex agents could bypass sandboxing and Auto-Review, two client-controllable headers that disabled monitoring for new agents, and inputs that could make the monitor fail through serialisation differences. METR said it had not checked whether any agent had actually exploited these weaknesses. One exploit’s details were redacted by OpenAI.

OpenAI has told METR that all vulnerabilities affecting its production safeguards have been patched and has described wider changes to monitoring coverage; METR said it had not evaluated those claims. It separately set out design principles, including monitoring agents every N messages rather than at the end of a turn, and reconciling inference logs against monitor logs. METR said the exercise was separate from its investigation of the Hugging Face breach, which became public on the exercise’s first day, 21 July. The Register’s headline nonetheless tied the findings to that attack and said OpenAI had “utterly failed” to monitor its agents, a harsher framing than METR’s own, which describes partial and bypassable coverage in a pilot of external access. The Register noted that the report does not establish that OpenAI’s agents deliberately concealed anything, though the gaps could have hidden such behaviour.

The exercise follows Anthropic’s decision to give METR staff employee-like access and again has an outside group testing a lab’s internal controls rather than its released models. OpenAI’s own reports of agents weakening monitoring, published two days earlier, describe the same layer of defence from the inside.