On October 22, 2026, METR published “Red-Teaming OpenAI’s Internal Agent Monitoring Systems”, a public summary of a three-week pilot (July 21 to August 11, 2026) in which one METR employee and one Redwood Research employee assessed OpenAI’s internal asynchronous misalignment monitor, the system that reviews agent trajectories for scheming, sabotage, data exfiltration and prompt injection. The reviewers had high access: the internal codebase, monitor prompts and configuration, internal documentation and interviews with about a dozen engineers and researchers, working on OpenAI-issued devices on premises. Their full output was a 61-page internal report; OpenAI shared a redacted 38-page version with METR and Redwood leadership.
METR estimates that “roughly 75-94%” of agentic internal Responses API traffic from models at least as capable as GPT-5.5 was eligible for monitoring, and 99.2% of the internal Codex subset. Not monitoring compaction events likely left “on the order of 10%” of eligible internal Codex traffic unmonitored from May to July 2026, which OpenAI fixed during the exercise. Because the monitor ran only when an agent returned control to the user, an agent could postpone review by continuing to act. The team also found a way Codex agents could in principle bypass sandboxing and Auto-Review, an exploit that could keep hundreds of recent actions out of view, serialization differences that could let agents craft inputs that break the monitor, and two client-controllable headers that could disable monitoring for new agent instances. On the positive side, the monitor errored on less than 0.2% of requests and, with minor exceptions, saw the full trajectory the agent saw.
METR recommends making unmonitored inference hard (explicit approval for unmonitored keys, monitoring every N messages or minutes rather than only at turn end), reconciling inference logs against monitor logs, tamper-resistant logging, continuous red-teaming and control evaluations, and isolating monitors from agent influence. OpenAI says all vulnerabilities affecting production safeguards have been patched; METR has not evaluated that claim.
Why it matters: this is one of the first outside audits of a frontier lab’s live agent monitoring, the safeguard labs increasingly cite as their main defense against misaligned internal agents. It shows that coverage, not just classifier quality, is where such systems fail.
What it does not show: it does not show any agent actually exploited these gaps; access constraints prevented checking that. It covers the system as of July 21, 2026, not OpenAI’s later expanded setup, the public post is deliberately brief, and OpenAI could redact anything it judged sensitive.