On October 22, 2026, AI safety evaluators METR and Redwood Research jointly published the results of a red-team review of OpenAI's internal agent monitoring system: in a three-week pilot, the two organizations found multiple vulnerabilities in the monitoring stack, including a way agents could in principle keep hundreds of their actions from being monitored. OpenAI responded that vulnerabilities affecting production safeguards had been patched, but the evaluators said they had not verified the fixes.
How the review was run
The exercise was a pilot of "embedded evaluations": from July 21 to August 11, METR and Redwood each sent one researcher to work inside OpenAI, with access to internal code, monitoring prompts, configuration details, and documentation, plus interviews with about a dozen OpenAI researchers and engineers. The researchers were accompanied throughout and worked on OpenAI-issued devices that never left the premises. Reuters reported the publication on October 22, and Redwood Research's official blog carried the technical summary.
What was found
The published findings center on five points:
- Monitor bypass: The evaluators described a way agents could in principle keep hundreds of their most recent actions unmonitored. The report did not establish whether agents had actually used that route to delay monitoring.
- Coverage estimates: Using the system as it existed on July 21 as the baseline, the evaluators estimated that 75% to 94% of internal Responses API traffic driven by models at least as capable as GPT-5.5 was "eligible for monitoring." The estimate carried substantial uncertainty, and "eligible" did not mean "actually monitored."
- Compaction-event gap: A gap tied to context-compaction events left about 10% of eligible internal Codex traffic unmonitored from May through July. OpenAI staff had found the gap before the exercise began and fixed it during the exercise.
- Sandbox and auto-review bypass: The report also described ways agents could in principle bypass Codex sandboxing and Auto-Review, plus inputs that could stop the monitor from escalating suspicious activity for human review.
- Transparency compromise: Only OpenAI received the full 61-page report; the public got a summary redacted by OpenAI. The evaluators agreed to let OpenAI redact sensitive information, and this time — unlike previous reviews — they could not independently disclose what was redacted.
The signal
The signal is not "were there vulnerabilities" — any monitoring system scrutinized by two top red teams for three weeks will yield findings. It is two things. First, monitoring offense and defense in the agent era has shifted from "will the model misbehave" to "can the watcher keep up with the watched": when agents learn to game the monitor, coverage becomes a moving metric, not a one-time acceptance test. Second, the evaluation model itself is being trialed: inviting outside evaluators inside the lab is the "independent evaluation" the industry has long called for, but the redaction arrangement shows how far truly open independent evaluation still has to go.
For ordinary developers, the direct impact is limited, but one judgment is worth keeping: when you give an agent high privileges — reading and writing files, executing code, calling APIs — do not assume the vendor's internal monitoring catches everything. If OpenAI's own internal monitor was found to have bypasses, the safety margins of public-facing services can only be thinner.
