AI safety evaluators METR and Redwood Research identified multiple vulnerabilities in OpenAI’s internal AI monitoring system during a three-week exercise conducted from July 21 to August 11, 2026, including ways AI agents could potentially bypass monitoring safeguards, evade escalation for human review and circumvent sandbox restrictions.
The evaluators described the exercise as a pilot designed to give external researchers deep access to OpenAI’s internal infrastructure, including its codebase, misalignment-monitor prompts, configuration details and documentation. They also interviewed approximately a dozen researchers and engineers across monitoring, safety-systems and security teams.
This summer, we invited METR and Redwood Research to pilot an embedded evaluation of our internal monitoring system, providing deep access to our infrastructure over three weeks.
Their findings helped strengthen safeguards as we expanded the system and will help shape future research collaborations with METR and other third party evaluators.
— OpenAI (@OpenAI) October 22, 2026
To enable this level of access, they worked on OpenAI-issued devices, which never left the premises, and were accompanied while onsite,” the AI safety evaluators said.
External AI safety evaluations can strengthen safeguards but raise concerns about exposing companies’ proprietary information to competitors.
The findings from the exercise, which involved one researcher from each organization, were detailed in a 61-page internal report shared with OpenAI researchers and security staff.
The assessment focused on OpenAI’s internal misalignment-monitoring system as it existed on or before July 21, 2026, and did not evaluate changes that were underway at the time of the exercise.
The researchers estimated that 75% to 94% of agentic traffic through OpenAI’s internal Responses API from models at least as capable as GPT-5.5 was eligible for monitoring. For the subset of Responses API traffic used by internal Codex agents, the estimated figure was 99.2%.
However, the assessment identified gaps in monitoring coverage. Reinforcement learning training runs were not covered by the monitoring system at the start of the exercise, although a subset of training rollouts had reportedly been monitored between March and June 2026.
The researchers estimated that the failure to monitor compaction events likely left around 10% of eligible internal Codex traffic unmonitored between May and July 2026, although they noted substantial uncertainty around the estimate. “OpenAI staff had independently identified this before the exercise began, and fixed this during the exercise,” the evaluators said.
The researchers found that Codex agents could potentially bypass sandboxing and Auto-Review safeguards, while an exploit could prevent hundreds of recent actions from being monitored. They also identified ways to disable monitoring for new agents and prevent the monitor from escalating certain activity for human review.
The evaluators also identified two unmonitored internal agentic tools believed to have read-only permissions that could potentially be exploited to take arbitrary actions within their sandboxed environments. However, they did not establish whether the exploit worked in practice.
Earlier, OpenAI engaged METR and Redwood Research to independently review its AI agents’ behavior following a sandbox escape and reported breaches involving Hugging Face and other organizations.
