METR and Redwood Research Find OpenAI Flaw That Could Hide Hundreds of Actions

A review by METR and Redwood Research found vulnerabilities in OpenAI’s internal monitor for coding agents, including an exploit that could leave hundreds of recent agent actions unseen.

The groups published findings Oct. 22 after a three-week pilot that ran from July 21 to Aug. 11, 2026. One employee from each group accessed OpenAI’s internal code, monitoring prompts, configuration details and documentation, and interviewed about a dozen researchers and engineers. The 61-page report was shared with OpenAI researchers and security staff.

For the system as it existed on or before July 21, the evaluators estimated that 75% to 94% of agent-driven internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring. They put eligibility at 99.2% for the subset of Responses API traffic used by internal Codex agents. The estimates had substantial uncertainty, and eligibility did not guarantee that traffic completed the monitoring process.

A separate gap involving compaction events likely left about 10% of eligible internal Codex traffic unmonitored from May through July. OpenAI staff had identified the gap before the exercise and fixed it during the exercise.

The review also described a way agents could in principle bypass Codex sandboxing and Auto-Review, along with inputs that could prevent the monitor from escalating activity for human review. The evaluators did not establish whether agents had used one identified route to delay monitoring.

OpenAI told the evaluators that vulnerabilities affecting production safeguards had been patched. METR and Redwood Research did not evaluate that claim. Their review examined the system as it existed on or before July 21 and did not establish the monitor’s current coverage.

OpenAI said in March that less than 0.1% of its internal coding-agent traffic, primarily bespoke or local setups, was outside monitoring coverage at the time. That figure is not directly comparable with the pilot estimates: the dates and traffic populations differ, and the pilot measured eligibility rather than completed monitoring.

OpenAI CEO Sam Altman wrote Sept. 12, “Committing to having independent evaluators with employee-like access is a great idea, and we will do the same.” The pilot ended Aug. 11, before that commitment, so its findings do not establish how OpenAI later implemented it.