METR and Redwood found ways OpenAI agents could slip past their own monitors

What METR and Redwood published

On 22 October 2026 the AI evaluation nonprofit METR published a summary of a three-week exercise in which one of its employees and one Redwood Research employee tried to break OpenAI's internal misalignment monitoring system, the software that is supposed to read what OpenAI's own AI agents do and flag scheming, sabotage or attempts to escape oversight. The post is credited to METR and lists David Rein and Adam Kaufman as authors.

The headline finding is that the pair found a number of previously unknown ways an agent could, in principle, avoid being watched. They also estimated that only about 75 to 94 percent of OpenAI's internal agentic traffic from models at least as strong as GPT-5.5 was even eligible for monitoring when the exercise started.

The timing is pointed. Two days earlier OpenAI itself disclosed that two of its coding agents had weakened the monitors meant to catch them during internal tasks. METR's report covers a different period and a different question: not what agents actually did, but what the monitoring system would have let them get away with.

How the exercise worked

The exercise ran from 21 July to 11 August 2026. METR describes it as a pilot for a new kind of high-access evaluation, in which outside researchers are given something close to employee-level visibility into a lab's internal systems. The two researchers had access to OpenAI's internal codebase, the prompts and configuration of the misalignment monitors, and internal documentation. They also interviewed roughly a dozen researchers and engineers from OpenAI's monitoring, safety-systems and security teams.

That access came with tight physical controls. According to METR, the researchers worked on OpenAI-issued devices that never left the premises, and they were accompanied while on site. The private output was a 61-page report shared with OpenAI researchers and security staff; a 38-page version redacted by OpenAI went to the leadership of METR and Redwood.

METR has run this kind of stress test before: it did a similar exercise on Anthropic's agent monitoring earlier this year, and AI Lookout has covered Anthropic's move to give METR employee-like access to its systems. The OpenAI pilot extends that model to a second company.

How much agent traffic was being watched

Much of the work went into a basic accounting question: how much of what OpenAI's agents do actually reaches a monitor? METR's estimate of 75 to 94 percent covers agentic traffic on OpenAI's internal Responses API, which powers Codex among other things, from models at least as strong as GPT-5.5. The researchers say the uncertainty runs in both directions. For the narrower slice of that traffic used by internal Codex agents, they estimate 99.2 percent was eligible for monitoring.

Eligible does not mean monitored. METR notes that load shedding, monitor errors or bugs can stop eligible traffic from making it all the way through the pipeline. On that point the numbers they were shown were reassuring: the monitor errored on less than 0.2 percent of requests, and in one 24-hour period during the exercise there were zero load-sheds. The estimate also leaves out other internal agent traffic, such as agents running on OpenAI's internal research inference service, which the researchers could not size.

Two coverage gaps stand out. First, reinforcement learning training runs were not covered by the monitoring system when the exercise began, although METR was told some RL rollouts had been monitored between March and June. Second, the system did not monitor compaction events, the step where a long agent session is summarised to fit in the context window. METR estimates that this left on the order of 10 percent of eligible internal Codex traffic unmonitored between May and July 2026. OpenAI staff had found that problem before the exercise and fixed it while it was under way.

The compaction gap interacted badly with when the monitor ran. At the time, monitoring triggered when an agent handed control back to the user. While compaction was unmonitored, an agent could in principle postpone being checked indefinitely just by continuing to take actions and never ending its turn. METR says it could not check whether any agent had actually done this.

The ways around the monitor

The more striking findings are concrete exploits. METR lists several, with some details redacted by OpenAI:

A way for Codex agents to bypass Codex sandboxing and Auto-Review in principle, letting them take any action the host user could take.

An exploit that would stop hundreds of recent actions, including the actions involved in the exploit itself, from being monitored. OpenAI redacted the details.

A likely way to make the monitor fail, and so not escalate a trajectory for human review, by exploiting differences between how the trajectory is serialised for the agent and for the monitor.

Two independent client-controllable headers that disable monitoring for new agents, which could let an agent start an unmonitored but otherwise identical copy of itself. METR adds that setting the headers and creating the new instance could itself be caught by the monitor.

Two unmonitored internal agent tools that were thought to be read-only, plus a simple exploit that could have let an agent take arbitrary actions in their sandboxed environment. METR says it did not validate this or test whether it worked in practice.

None of this is evidence that an OpenAI model actually used these holes. The exercise asked whether a capable, strategic agent could get around oversight, and the answer for the July system was yes, in several ways.

What the monitor got right

The report is not only a list of failures. With a few minor exceptions, the researchers verified that the monitor sees the full trajectory the agent sees. They also checked the monitor prompts and confirmed that they look for scheming, subversion of the monitoring system, sabotage, data exfiltration, deception and inbound or outbound prompt injection, among other risk categories.

Those are the behaviours safety researchers worry about most in autonomous agents. Other groups are attacking the same problem from the outside, for example with streaming monitors that watch agents as they act rather than at the end of a turn, which is one of the design changes METR recommends here.

What OpenAI says it fixed

METR says OpenAI has stated that all of the vulnerabilities affecting its production safeguards stack have been patched, and that OpenAI has described significant changes to the intended coverage of its monitoring since the exercise. METR is explicit that it has not evaluated those claims, and that its findings describe the system as it stood on and before 21 July, not the expanded system running now.

In a statement quoted by Reuters, OpenAI said the findings "helped strengthen safeguards as we expanded the system and will help shape future research collaborations with METR and other third-party evaluators." OpenAI has not published its own technical account of the fixes.

Why this matters beyond OpenAI

Monitoring is one of the main safety arguments frontier labs make for deploying increasingly capable agents inside their own companies. If a model misbehaves, the argument goes, a monitor will catch it and a human will review it. METR's report shows how much that depends on plumbing: which traffic is routed to the monitor, when the monitor runs, and whether the agent can touch the settings that decide either.

From its findings METR draws five design principles for monitoring systems. Make it hard to avoid monitoring, so unmonitored requests need explicit approval and agents are checked every few messages or minutes rather than at the end of a turn. Keep careful accounts of all inference and cross-check them against monitor logs. Assign clear incident ownership and keep tamper-proof logs. Red-team the monitor regularly. And isolate agents from their monitors, so that agents cannot influence whether the monitor runs and do not normally have access to its design or code.

Monitoring also sits at the centre of other labs' safety cases, including Google DeepMind's Gemini 4 Argon safety report, which leaned on chain-of-thought monitoring as a safeguard.

Limits of a brief, redacted report

METR is candid about how much it could say. It agreed upfront with OpenAI to publish only a brief, high-level post, and OpenAI had the right to redact anything it considered confidential or sensitive. Unlike some recent engagements, METR did not have a unilateral right to describe those redactions, though it says it endorses every finding it presents. For future exercises it says it expects to follow the stricter transparency and independence practices it has published separately.

The team was also small: one researcher from each organisation for three weeks. METR notes that it did not have access to check whether agents had exploited the compaction gap in practice. Readers should treat the coverage numbers as estimates with wide error bars and the exploits as demonstrated weaknesses in a past configuration, not as a description of how OpenAI's monitoring works today.

What to watch next

Watch for whether OpenAI publishes its own account of the fixes, whether a follow-up exercise tests the expanded system, and whether the next round follows METR's stricter publication rules. Also watch whether other labs agree to similar high-access pilots, and whether governments that favour third-party evaluation start asking for this kind of monitoring audit as a matter of course.