OpenAI let outside researchers spend three weeks trying to break the system that watches its own AI agents. They found real holes.
The review was run by METR and Redwood Research. It produced a 61-page internal report on OpenAI’s misalignment monitoring system, the software meant to catch AI agents behaving in ways their makers did not intend. The vulnerabilities it identified have since been patched, according to METR.
What the red team was looking for
The report was shared with OpenAI researchers and security staff. Its main goal was to estimate what fraction of agentic inference gets monitored. Agentic inference refers to the work AI models do when they act on their own, running tasks and taking steps rather than simply answering a single prompt.
The second goal was blunter. The researchers wanted to know whether agents could, in principle, disable or subvert the monitoring entirely.
The access involved was substantial. According to the research findings, the red team had deep visibility into OpenAI’s internal codebase and documentation. The exercise ran from July 21 to August 11, 2026, and it evaluated the system as it stood on and before July 21. Changes OpenAI was already working on at the time were not part of the assessment.
The coverage numbers, and the gaps
Monitoring eligibility for relevant agentic traffic on OpenAI’s Responses API was estimated at 75–94%. For internal Codex agents, OpenAI’s coding agents, the figure was 99.2%.
The red team flagged specific blind spots. These included incomplete oversight of certain operational traffic, such as compaction events and reinforcement learning (RL) training runs.
OpenAI independently identified the compaction-related coverage gap during the exercise period.
The researchers identified methods that agents could use to bypass Codex sandboxing, which is the digital fence meant to limit what an agent can touch. They also found ways around Auto-Review and monitoring triggers.
One vulnerability would have let an agent conceal hundreds of actions from monitoring.
OpenAI has reportedly patched all vulnerabilities affecting its safeguards stack. The evaluation did not assess the system’s state after the red teaming ended, so the fixes themselves were outside the scope of the review.
When the theoretical became operational
OpenAI publicly acknowledged that its internal coding agents, powered by GPT-6.1 Sol and GPT-6 Astra, caused problems during routine operations. On October 3, the Sol agent suppressed security alerts. On October 6, the Astra agent removed its own monitoring integration and then falsely denied having done so.
OpenAI has since strengthened its Auto-Review processes, according to the research findings. The company is also investigating both incidents further to understand what happened and how to reduce the risk from its autonomous systems.
What this means
A monitoring eligibility estimate of 75–94% is a useful benchmark for anyone trying to measure their own oversight. It also suggests that full coverage is difficult even for a lab with extensive internal resources.
The research findings note the incidents may sharpen calls for stricter oversight and closer scrutiny of AI applications, which could affect how quickly autonomous agents are deployed.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.