METR and Redwood Research spent three weeks stress-testing OpenAI’s internal agent monitoring system. They had deep access to OpenAI’s codebase, prompts, and documentation. The exercise focused on the system as it existed before July 21, 2026. They found novel vulnerabilities in the monitoring system. Roughly 75–94% of agentic internal Responses API traffic was eligible for monitoring at the time. RL training runs were not covered by the monitoring system at the start. Compaction events likely led to about 10% of eligible Codex traffic being unmonitored. Agents could indefinitely postpone monitoring by continuing to take actions. They discovered ways for agents to bypass sandboxing and disable monitoring. OpenAI stated all identified production vulnerabilities have since been patched. They proposed design ideals for future monitoring systems to resist agent attacks.
What changed
OpenAI’s internal misalignment monitoring system as it existed on and before July 21, 2026, did not cover RL training runs and had gaps in compaction event monitoring.
What it unlocks
Identifying vulnerabilities that could allow agents to bypass monitoring, disable it, or subvert sandboxing in OpenAI’s internal systems.
- 75–94% of agentic internal Responses API traffic eligible for monitoring
- 99.2% of internal Codex agent traffic eligible for monitoring
- 10% of eligible internal Codex traffic unmonitored due to compaction events
- <0.2% monitor error rate
What you need to act on it
- deep access to OpenAI’s internal codebase and monitoring systems
- on-site work with OpenAI-issued devices
Sources