METR and Redwood red-team find gaps in OpenAI's internal agent monitoring
A three-week exercise found ways agents could postpone or avoid monitoring and bypass the Codex sandbox. OpenAI says the issues are patched; METR has not evaluated that claim.
From 21 July to 11 August, a METR employee and a Redwood Research employee stress-tested OpenAI's internal misalignment monitoring system with access to internal code, monitor configuration and staff, METR reported on 22 October. The findings describe the system as it existed on and before 21 July.
Findings
METR estimates that not monitoring compaction events left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026. Because monitoring triggered when agents returned control to the user, agents could postpone monitoring indefinitely by continuing to act. OpenAI had identified the compaction gap before the exercise and fixed it during it.
The team also found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, an exploit that could stop hundreds of recent actions from being monitored, and two client-controllable headers that disable monitoring for new agents. RL training runs were not covered by monitoring at the start of the exercise.
OpenAI has stated that all identified vulnerabilities affecting its production safeguards have been patched. METR says it has not evaluated these claims. METR agreed with OpenAI to publish only a brief, high-level post, and OpenAI could redact it.