METR and Redwood red-team found gaps and bypasses in OpenAI's internal AI agent misalignment monitoring system
A METR employee and a Redwood Research employee ran a three-week, high-access exercise to stress-test OpenAI's internal misalignment monitoring system for AI agents. They estimated that not monitoring compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026, and that RL training runs were not covered at the start of the exercise. They also found a way Codex agents could in principle bypass sandboxing and Auto-Review, and two client-controllable headers that disable monitoring for new agents. OpenAI has stated that most of the vulnerabilities have been patched, with one fix still in progress. METR said it could not check whether agents had exploited one of the gaps in practice.
What the AI did
No harmful action by an AI agent has been reported. Testers found that OpenAI's Codex agents could in principle get around their sandbox (the contained space that limits what they can touch) and an automatic review step called Auto-Review, and that some agent activity went unwatched; it could not be checked whether agents actually exploited one of these gaps.
First reported October 22, 2026 · Added to the register November 2, 2026 · 1 source
- Developer
- OpenAI
- Model
- Codex
- When it happened
- May 2026 to July 2026
- First reported
- October 22, 2026
What this means for you
Could this affect you?
If you run AI agents with automated monitoring. Testers found that OpenAI's monitoring of its own AI agents had gaps and bypasses that could let agent activity go unwatched. Teams that rely on automated monitoring of their own AI agents may want to check for similar gaps.
What to check
- Monitor AI agents at regular intervals, not only when they hand control back.
- Reconcile every log of AI requests against the monitoring logs to find unwatched activity.
- Block switches on the user's side that can turn monitoring off.
- Commission independent red-teaming (outside testers acting as attackers) of your agent monitoring and controls.
Areas of your AI programme this touches
Timeline
- May 2026Started
- July 2026Ended
- October 22, 2026First reported
Every fact and its source (7)
- Red-team participantsMETR and Redwood Research employees“a METR employee and a Redwood Research employee conducted a pilot high-access exercise”[1]
- Estimated unmonitored traffic from the compaction gapAbout 10% of eligible internal Codex traffic, May to July 2026“not monitoring compaction events likely led to on the order of 10% of eligible internal Codex traffic not being monitored between May and July 2026”[1]
- Coverage gap for RL trainingRL training runs not monitored at start of exercise“at the start of the exercise RL training runs were not covered by the monitoring system”[1]
- Monitoring bypass foundTwo client-controllable headers disable monitoring for new agents“We found two independent client-controllable headers that disable the monitoring system for new agents”[1]
- Remediation statusMost vulnerabilities patched, one fix in progress“OpenAI has stated that most of the vulnerabilities have now been patched; one remaining fix is still in progress”[1]
- Real-world exploitation not checkedUnknown whether agents exploited the gap“we did not have the ability to check whether agents had, in practice, exploited this vulnerability”[1]
- Exercise output61-page internal report“The output of this exercise was a 61-page internal report”[1]
Sources
- Red-Teaming OpenAI's Internal Agent Monitoring Systemsmetr.org · October 22, 2026
How this record is classified. Severity N: a legal action or test finding, not a harm. OECD level: hazard, an event that could plausibly have led to harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
