Outside researchers find gaps in OpenAI's system for monitoring its AI agents

In short

Redwood Research and METR, two AI safety research groups, say two of their staff spent three weeks testing OpenAI's internal system for monitoring its AI agents. They found several ways agents could, in principle, avoid being checked. OpenAI says the problems affecting its live safeguards have been fixed. The researchers say they have not checked that claim.

What happened

From July 21 to August 11, 2026, one METR employee and one Redwood Research employee carried out a "red-teaming" exercise, which means deliberately looking for weaknesses. The target was the system OpenAI uses inside the company to watch its AI agents for misbehaviour. AI agents are AI models that take actions on their own, such as writing and running code. The exercise looked at the system as it stood on and before July 21, not at changes OpenAI was making during the exercise.

The two researchers had deep access. They could see OpenAI's internal code, the instructions given to the monitor, and internal documents. They also interviewed about a dozen OpenAI staff. They worked on OpenAI devices that stayed on site. They wrote a 61-page private report for OpenAI. The public post is a short summary, and OpenAI was allowed to remove sensitive details.

Among the findings the post lists:

• The researchers estimate that roughly 75–94% of certain internal agent traffic was set up to be monitored. They say this estimate is quite uncertain.
• At the start of the exercise, RL training runs were not monitored. RL, or reinforcement learning, is a way of training models through trial and reward.
• About 10% of one type of agent traffic was likely not monitored between May and July. This was because "compaction" steps were skipped. Compaction is when an agent's long working record is shortened. OpenAI staff had already spotted this and fixed it during the exercise. During that period, agents could have put off being checked indefinitely by simply continuing to act.
• They found a way agents could, in principle, get around a sandbox (a locked-down space where agents work) and take any action their human user could.
• They found an exploit that could hide hundreds of recent actions from the monitor. OpenAI removed the details.
• They found two settings an agent could use to start a new copy of itself without monitoring. Using these settings could itself be caught.

The researchers also found that the monitor sees almost everything the agents see. It checks for problems such as deception, sabotage and data theft.

What was done about it

OpenAI has said that every weakness found that affects its live safeguards has been patched. It has also described major later changes to what its monitoring covers. The researchers say they have not evaluated these claims. They also set out design ideas for future systems. These include checking agents at regular intervals, keeping careful records of what is monitored, and keeping agents separate from their monitors.

Why it matters

The post does not report any agent actually using these gaps. For the compaction gap, the researchers say they were not able to check whether agents had used it. The groups say future monitoring systems should be able to resist "deliberate, strategic, and sustained attacks" from highly capable AI agents. They describe this exercise as a pilot for giving outside researchers deep access to a company's internal systems. They say they expect future versions to be more open and more independent.

The original report