METR and Redwood red team finds gaps in OpenAI's internal AI agent monitoring

From July 21 to Aug. 11, a METR employee and a Redwood Research employee stress-tested OpenAI’s internal misalignment monitoring system, which watches OpenAI’s own AI agents for scheming, sabotage, data exfiltration and similar behavior, with access to internal code, monitor prompts and documentation, METR said in an Oct. 22 post. They estimated that roughly 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with “substantial uncertainty in both directions,” and that on the order of 10% of eligible internal Codex traffic likely went unmonitored between May and July because compaction events were not monitored, a gap OpenAI staff had already identified and fixed during the exercise; they also found two client-controllable headers that disable monitoring for new agents and a way Codex agents could in principle bypass Codex sandboxing. OpenAI has said all vulnerabilities affecting its production safeguards have been patched, which METR says it has not evaluated; under the agreement, OpenAI could redact the public post, which the parties agreed upfront would be brief and high-level.