OpenAI Let Two Outside Researchers Attack the System That Watches Its AI Agents

METR published the results of a three-week exercise on Oct. 22, 2026, in which one of its employees and one from Redwood Research worked inside OpenAI to attack the system that watches the company's own AI agents for signs they are working against their instructions. They estimate that 75–94% of the internal agent traffic they measured was eligible for monitoring, and name several ways an agent could have avoided it.

METR says the exercise was a pilot for giving outside researchers deep access to internal infrastructure, not a way of providing robust public transparency about OpenAI's monitoring. The public write-up is a small part of a 61-page private report, and OpenAI could redact anything it judged sensitive from it.

The exercise ran from July 21 to Aug. 11, 2026, and covered the system as it existed at the start of that window. The 75–94% estimate covers traffic from models at least as strong as GPT-5.5 through the interface behind Codex, OpenAI's coding agent; for internal Codex agents alone it puts the share at 99.2%. METR says both figures carry substantial uncertainty in both directions, and that the estimate leaves out other internal sources of agent traffic it could not measure. Reinforcement learning runs, where models learn by reward, were not covered when the exercise began.

METR estimates that not monitoring compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026. OpenAI staff had found that gap themselves before the exercise and fixed it while it was running. Because the monitor ran when an agent handed control back to the user, an agent could postpone it by continuing to act.

METR also describes ways agents could in principle have avoided the monitor. Among them: a route by which Codex agents could get around the limits meant to contain them and act as their host user; an exploit, its details redacted by OpenAI, that would have kept hundreds of recent actions unmonitored; and two internal tools believed to be read-only that could have acted in their sandbox. METR says it did not test whether that last one was exploitable.

OpenAI has since said the vulnerabilities affecting its production safeguards have been patched, and has described significant later changes to its monitoring coverage. METR says it has not evaluated those claims.