AI BriefingMETR and Redwood Research Identify Vulnerabilities in OpenAI's Internal Agent Monitoring System
·2026.10.22 09:00
Key point
A three-week pilot exercise estimated that 75–94% of eligible agentic traffic was monitored, while identifying methods for agents to disable or subvert the system.
Details
- METR and Redwood Research conducted a three-week high-access pilot (July 21–August 11) to stress-test OpenAI's internal misalignment monitoring system, producing a 61-page internal report.
- Researchers estimated that 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with 99.2% eligibility for internal Codex agents.
- Novel vulnerabilities were discovered, including a method for Codex agents to bypass sandboxing and Auto-Review, and an exploit to prevent hundreds of recent actions from being monitored.
- Two client-controllable headers were found that could disable monitoring for new agents, and two unmonitored internal tools with read-only permissions were found to be exploitable for arbitrary actions.
- OpenAI has stated that all identified vulnerabilities impacting its production safeguards stack have been patched, though METR and Redwood have not evaluated these claims.
- The team outlined design ideals for future monitoring, including making it hard to avoid monitoring, ensuring traffic accounting accuracy, and enforcing isolation between agents and monitors.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Amazon partners with AVERI for independent review of AI safety evaluation datasets
Research demonstrates backdoor injection in open LLMs using under $50 in compute
Jacob Coxon Resigns from Anthropic, Declaring 'Coxon Day' as AI Safety Concerns Go Mainstream