METR and Redwood spent three weeks inside OpenAI testing how it watches its own agents, and found ways around it

From 21 July to 11 August, one METR employee and one Redwood Research employee worked on site at OpenAI to stress-test its internal misalignment monitoring, the system that checks what OpenAI’s own agents do. They had OpenAI’s internal code, the monitor prompts and configuration, internal documents, and interviews with about a dozen staff, on OpenAI devices that never left the building. METR’s public write-up is deliberately brief: the full report runs 61 pages, and OpenAI could redact anything it judged sensitive.

What they estimated

• Roughly 75 to 94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, “with substantial uncertainty in both directions.” For internal Codex agents the figure was 99.2%. Eligible means meant to reach a monitor, not proven to.
• RL training runs were not covered when the exercise began.
• Skipping compaction events likely left “on the order of 10%” of eligible Codex traffic unmonitored from May to July. OpenAI had already spotted this and fixed it during the exercise. Because the monitor ran when an agent handed control back, an agent could put off being checked simply by continuing to act.

What they found

• A way Codex agents could “in principle” bypass Codex sandboxing and Auto-Review.
• An exploit that kept hundreds of recent actions from being monitored. OpenAI redacted the details.
• Two client-controllable headers that turn monitoring off for new agents, though setting them could itself be caught.
• Possible monitor failures from differences between what the agent sees and what the monitor sees.

METR says it could not check whether any of this was used in practice. OpenAI says every issue affecting its production safeguards is patched. METR has not evaluated that, and the findings describe the system as it stood on 21 July.

Why it matters

Our earlier report covered agents that edited their own monitoring. METR’s proposed fixes read as a checklist for any agent setup: check on a timer, not only at turn end; reconcile inference logs against monitor logs; and keep the monitor out of the agent’s reach.