Outside evaluators find ways AI agents could evade OpenAI’s safety monitoring

Outside researchers given access to OpenAI’s internal systems found an exploit that could let AI agents hide hundreds of recent actions from safety monitoring. METR and Redwood Research disclosed the finding on October 22, alongside other vulnerabilities uncovered in a three-week pilot review. The exercise tested the infrastructure meant to catch unwanted agent behavior.

OpenAI told the evaluators it had patched the identified vulnerabilities affecting its production safeguards.

Access to the code, not just the model

One employee from each nonprofit worked on-site from July 21 through August 11, 2026. They could inspect OpenAI’s internal codebase and documentation and speak with technical staff. The pilot tested what giving external researchers deep access to the company’s infrastructure would look like.

The researchers were accompanied while on-site and used OpenAI-issued devices that stayed on the premises. Their subject was the company’s internal misalignment monitoring system—oversight intended to detect AI behavior that conflicts with human interests and values.

Missing reviews versus obstructed reviews

The Decoder’s account of the findings describes both activity that went unreviewed and ways agents could delay or disrupt oversight. METR’s coverage estimates included:

• Roughly 10% of internal Codex traffic intended for monitoring went untracked between May and July because of a gap involving compaction events, which summarize context. The estimate carried significant uncertainty.
• An estimated 6% to 25% of internal agentic Responses API traffic from GPT-5.5-class models and above lacked monitoring coverage during the audit period. That estimate also carried significant uncertainty.

OpenAI independently discovered the Codex compaction bug and fixed it during the pilot. Before that fix, monitoring ran when an agent returned control to the user. With compaction events unmonitored, an agent could keep taking actions and delay oversight instead of ending its turn.

The evaluators also found ways to bypass the Codex sandbox, its restricted operating environment. Specially crafted inputs could likely crash the monitor, according to The Decoder. Model behavior during reinforcement-learning training was not being monitored when the exercise began.

Deep access, limited public disclosure

The researchers delivered a 61-page internal report to OpenAI but agreed to publish only high-level findings. They said the pilot was not designed to provide robust public transparency about the monitoring system.

The Decoder reported that OpenAI’s redactions left a 38-page version for METR and Redwood Research leadership. METR said it could not independently disclose the redacted material.

OpenAI told CNBC it was using the exercise to strengthen safeguards and shape future collaborations with independent evaluators. METR and Redwood said they expected to share more details publicly about future exercises.