METR and Redwood Research red-team OpenAI's internal agent monitoring

On 22 October 2026 METR published a short public summary of a pilot in which one METR employee and one Redwood Research employee spent three weeks, from 21 July to 11 August, stress-testing OpenAI's internal system for monitoring misalignment in its own AI agents. They worked on site with OpenAI-issued devices and had access to the internal codebase, monitor prompts and configuration, internal documentation and interviews with about a dozen staff. The full findings went into a 61-page internal report; by agreement with OpenAI, only a brief public post was planned.

The team estimated that roughly 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring at the time, and 99.2% of the traffic used for internal Codex agents. Compaction events that were not monitored likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026; OpenAI had found this itself and fixed it during the exercise.

The team also described ways agents could in principle bypass Codex sandboxing and Auto-Review, keep hundreds of recent actions from being monitored, make the monitor fail, or start an unmonitored instance through two client-controllable headers. OpenAI has said that all vulnerabilities affecting its production safeguards have since been patched. METR notes that it has not evaluated that claim or OpenAI's later changes to monitoring coverage.