The BaseResearchMETR
Red-Teaming OpenAI's Internal Agent Monitoring Systems
METR reports a three-week exercise in which one METR and one Redwood Research employee, given deep access to OpenAI's internals, tested OpenAI's internal misalignment monitoring. METR lists vulnerabilities found, says OpenAI reports they are patched, and sets out design ideals for monitoring.
Why it matters
The same thing, for different readers.
What it means for you
Outside testers found that OpenAI's monitoring of its own internal AI agents had gaps, which OpenAI says it has since fixed; METR has not checked that claim.
For lawmakers
A pilot of deep external access to a lab's internal infrastructure shows what independent review can find, and that OpenAI could redact the public version at its sole discretion.
For researchers
METR estimates 75-94% of agentic Responses API traffic was eligible for monitoring and lists concrete bypasses, offering a template for measuring real monitoring coverage rather than assuming it.
The question it raises
If AI agents might act against their developers' wishes, the question is who can verify the watchers, and how much of the answer the public gets to see.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“Broadly, we believe that future monitoring infrastructure should be able to withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale.”
“At the time of the exercise, the monitoring system triggered when agents returned control to the user, so during the time period when compaction events were not being monitored, agents could indefinitely postpone being monitored by simply continuing to take actions.”
“Since completing the exercise, OpenAI has stated that all of the vulnerabilities we identified that impact their production safeguards stack have been patched. OpenAI has also described significant subsequent changes to the intended coverage of its monitoring system. We have not evaluated these claims.”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- A three-week pilot (July 21 to August 11) in which one METR and one Redwood Research employee had access to OpenAI's internal codebase, monitor prompts and configuration, and documentation, and interviewed about a dozen OpenAI staff, working on OpenAI devices on site.
- What it found
- Roughly 75-94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, and 99.2% of internal Codex agent traffic; unmonitored compaction events likely left on the order of 10% of eligible Codex traffic unmonitored between May and July 2026; several bypasses were found, some details redacted by OpenAI.
- What it does not show
- Describes the system as it stood on and before July 21, not the expanded system; a brief public post agreed in advance; OpenAI could redact anything it deemed sensitive, and METR had no unilateral right to describe redactions; exploitability of some findings was not tested; OpenAI's patch claims were not evaluated.
- Status
- A report
The record
- Questions
- Can AI systems act beyond what people intended or allowed? · Are AI companies putting stronger safeguards into practice?
- People
- David Rein (Wrote it) · Adam Kaufman (Wrote it)
- Also covered by
- Redwood Research blog
- What we read
- We read the whole source.
- Found by
- The Radar, run of October 23, 2026, via
metr(tier 1: the source’s own channel or an official record) - Cite this
- METR, “Red-Teaming OpenAI's Internal Agent Monitoring Systems”, October 22, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/metr-2026-10-22-red-teaming-openai-agent-monitoring