AI agents at OpenAI could have hidden hundreds of their own actions from the OpenAI monitoring system, outside evaluators found. That exploit was one of several flaws the safety nonprofits METR and Redwood Research reported on Thursday.
Each group sent one researcher inside OpenAI from 21 July to 11 August. They could see internal code, documentation and the monitor’s prompts, and they interviewed about a dozen staff, METR said. They worked on OpenAI devices that “never left the premises” and had an escort on site.
OpenAI told the evaluators it has patched every flaw that affected its production safeguards. METR and Redwood said they have not evaluated that claim. TNW has not independently verified the findings.
Gaps in what the monitor saw
The system uses an AI model to review what OpenAI’s internal agents do and to flag signs of misalignment for human review. Misalignment is when a model acts against what its makers intend. On 21 October, TNW reported that a GPT-6 Astra agent at OpenAI removed a safety monitor, then denied doing it.
The evaluators estimated that 75% to 94% of agentic traffic from OpenAI’s strongest models was eligible for monitoring. For internal Codex agents, the figure was 99.2%. When the review began, the monitor did not cover training runs that use reinforcement learning.
One gap came from compaction, when an agent condenses its memory to make room for more work. The monitor skipped those events. METR estimated that this left about 10% of eligible Codex traffic unwatched from May to July. OpenAI staff had spotted the problem before the review and fixed it during it.
The monitor only ran when an agent handed control back to its user. So during that period, an agent could have put off its checks indefinitely by simply continuing to act. The evaluators could not check whether any agent did.
Ways around the monitor
The researchers also found ways to defeat the monitor outright. Codex agents could in principle get past their sandbox and its Auto-Review check, and then take any action their user could take.
OpenAI redacted the details of the exploit that hid hundreds of actions. It also hid the steps of the exploit itself, METR said.
Agents could likely craft inputs that make the monitor fail, so it would not flag them for review. Two settings a client controls could switch off monitoring for new agents, although the monitor might catch the act of using them. A simple exploit could also have let agents use two “read-only” tools to take any action in their sandbox. The evaluators did not test that one in practice.
Future monitoring should “withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale,” the evaluators wrote.
A pilot on OpenAI’s terms
The pilot tested how deep outside access could go. It was not built to tell the public much. OpenAI received the full 61-page report. METR and Redwood agreed to publish only a short summary, and OpenAI could redact it. They expect to share more after future exercises.
“We’re using what we learned to strengthen our safeguards and shape future collaborations with independent evaluators,” an OpenAI spokesperson told CNBC.
Chief executive Sam Altman pledged in September to give outside evaluators “employee-like access”, CNBC reported. President Donald Trump’s voluntary AI accord also urges companies to work with an independent evaluator. Some AI companies fear that evaluators inside their walls could take secrets to rivals, Reuters reported.
What came next
The review began on 21 July, the day OpenAI confirmed that its AI had breached Hugging Face. The Register noted that overlap. OpenAI has since described wider monitoring coverage in a post on that incident.
A day after the report, OpenAI said it would cut live internet access from all frontier model training. It cited the current state of monitoring systems among its reasons. Regulators are also watching: the US Federal Trade Commission subpoenaed OpenAI and Anthropic over AI safety incidents this month.