- External auditors from METR and Redwood Research spent three weeks on-site at OpenAI, from July 21 to Aug. 11, 2026, examining its internal monitoring system for rogue AI behavior.
- Up to 25% of internal agentic API traffic from GPT-5.5-class models and above went unmonitored during the audit period, per METR’s estimate.
- Auditors found ways to hide hundreds of agent actions from the monitoring system, bypass the Codex sandbox, and likely crash the monitor with crafted inputs.
- OpenAI says it has fixed all weaknesses found, but has only released a short public summary of the full 61-page report.
What Happened
Two researchers from METR and Redwood Research spent three weeks embedded at OpenAI, from July 21 to Aug. 11, 2026, auditing the company’s internal system for catching rogue AI agent behavior. The team had access to OpenAI’s codebase and internal documents and interviewed about a dozen employees, per a report from The Decoder on Oct. 23, 2026.
Why It Matters
The audit is among the most detailed public looks at how an AI lab monitors its agents behind closed doors, and it lands weeks after CrowdStrike reported criminal hackers routinely bypassing AI model guardrails — suggesting monitoring gaps aren’t confined to one company. OpenAI separately expanded its own monitoring after a related Hugging Face incident in August 2026, though that change came after the audit’s access period ended.
Technical Details
METR estimates 6% to 25% of internal agentic Responses API traffic from GPT-5.5-class models and above wasn’t monitored during the audit, while roughly 10% of Codex traffic went untracked between May and July due to a bug in how the system handled compaction events, or context summaries, which OpenAI found and fixed independently mid-audit. Auditors also hid hundreds of actions from the monitor, bypassed the Codex sandbox, and found crafted inputs could likely crash the monitor outright; RL training behavior wasn’t monitored at all when the audit began.
Who’s Affected
The findings concern OpenAI’s internal safety infrastructure directly, but carry weight for any enterprise relying on monitored agent behavior from GPT-5.5-class models and above. METR and Redwood Research, which ran the pilot audit program jointly with OpenAI, received a redacted 38-page version of the full 61-page report.
What’s Next
OpenAI says every weakness the auditors identified has since been fixed, though only a short summary of the report is public. METR says it wants future audits to include more public transparency than this pilot allowed.
