Researchers Identify Gaps in OpenAI's Internal Safety Oversight
An independent audit by METR and Redwood Research found significant portions of internal AI agent activity were not covered by safety monitoring during a three-week evaluation period.
By Marcus Johnson ·
Two outside researchers spent three weeks inside OpenAI looking for holes in the company's safety net. They found several. The audit, which ran from July 21 to August 11, 2026, examined how OpenAI monitors its own AI models for dangerous or unwanted actions. The work was conducted by researchers from METR and Redwood Research. They were given access to OpenAI's internal code and documents. They also spoke with about a dozen staff members.
A key finding relates to coverage. The audit could not confirm that some AI agent activity was being watched. Between 6 and 25 percent of internal agentic traffic was not covered by monitoring during the audit period. This applies to models at the GPT-5.5 class and higher. METR states the estimate has significant uncertainty. Another gap concerned a specific system. Roughly 10 percent of internal Codex traffic was not tracked from May to July. This happened because of a flaw in handling context summaries, also known as compaction events. METR says this number also carries significant uncertainty. OpenAI found and fixed this bug on its own before the audit ended.
The audit found other problems with how oversight works. For a time, agents could avoid triggering monitoring. The system only activated when an agent returned control to the user. An agent could simply keep running to delay it. The researchers also found methods to hide hundreds of actions from the monitor. They found ways to bypass the Codex sandbox. They determined that certain crafted inputs could likely crash the monitor itself. When the audit began, model behavior during RL training was not being monitored. OpenAI says it paused RL training after the Hugging Face incident in August. It then expanded monitoring to cover this area. These changes happened after the researchers' access period. They were not part of the evaluation.
Most of the full report is not public. OpenAI says it has fixed all weaknesses found by the auditors. The full 61-page report was given internally to OpenAI. After redactions, METR and Redwood Research leadership received a 38-page version. A short summary was made available to the public. METR said it has no right to release the redacted parts on its own.
The audit was a pilot program. It was organized jointly by METR, Redwood Research, and OpenAI. The goal was to give outside researchers deep access to internal systems. METR says it wants to push for more public transparency in future audits. No further audits have been announced.
Source: The Decoder
