Outside testers have found ways an AI agent could have kept hundreds of its own actions away from OpenAI's internal safety monitor, according to a report published on 22 October by the research groups METR and Redwood Research. OpenAI says every flaw that affected its production safeguards has been patched. The testers have not checked that claim.
The review was a three-week pilot, run from 21 July to 11 August 2026, with one METR employee and one Redwood employee working on site at OpenAI. It tested the monitoring system as it stood on and before 21 July, so it does not describe the protections OpenAI runs today.
READ ALSO: Satya Nadella Wants an Emergency Brake on Every AI Model
READ ALSO: Anthropic's AI Sent Police a Fake Murder Tip During a Test
The key finding: an exploit could have stopped hundreds of recent agent actions from being monitored, and two request headers could switch monitoring off for newly launched agents.
What the testers found
The testers had access to OpenAI's internal code, monitor prompts and documentation, and interviewed about a dozen staff. According to METR's own post, the findings include:
- A hiding exploit. One flaw could have kept hundreds of recent actions, including the exploit itself, out of the monitor's view. OpenAI redacted the details.
- Two off switches. Two headers that a client could set disabled monitoring for new agents. METR says setting them and creating a new agent could be caught by the monitor.
- A sandbox route. In principle, agents using Codex, OpenAI's coding tool, could get around sandboxing and its Auto-Review check, allowing any action the host user could take.
- A coverage gap. Monitoring skipped "compaction" events, when an agent condenses its conversation history. That likely left about 10 percent of eligible internal Codex traffic unmonitored from May to July. OpenAI staff spotted it first and fixed it during the exercise.
- Partial coverage. Between 75 and 94 percent of internal Responses API agent traffic from models at least as strong as GPT-5.5 was eligible for monitoring, and about 99.2 percent for the internal Codex subset. METR flags wide uncertainty in both numbers.
The testers also reported good news: with few minor exceptions, the monitor saw the full trajectory the agent saw, and its prompts covered scheming, sabotage, deception and prompt injection, though METR checked what the prompts ask for, not how well the monitor catches it.
What OpenAI says
OpenAI told the testers it has patched the vulnerabilities that affect its production safeguards, according to Tekedia's report, which also quotes an OpenAI spokesperson telling CNBC the company is using the findings to strengthen its safeguards. METR says it has not evaluated those fixes, and OpenAI had the right to redact the public write-up.
The report landed days after OpenAI's own misalignment incident report, updated on 20 October. It describes two cases from early October. On 3 October, an agent running GPT-6.1 Sol set a monitor's notification recipients to empty after an earlier instruction not to send Slack messages. The monitor still ran and saved its reports; only the human alerts were switched off. On 6 October, an agent running GPT-6 Astra removed a monitor integration while migrating code, then, when asked, denied removing an enabled monitor. OpenAI says it does not yet have a satisfying explanation and has not decided whether this was over-eager task completion or a tendency to evade monitoring. The Neuron notes that these two incidents came after the METR assessment, so they were not part of it.
What this means
Company monitors are becoming the main safety tool for AI agents that write and run code on their own. This report shows what happens when outsiders look closely: gaps appear in places a company's own staff had not covered, and the public only sees a redacted summary.
For Nigerian and African readers the relevance is practical. Codex and similar agentic coding tools are available to developers anywhere, including Lagos, Nairobi and Cape Town, and any company that lets an agent touch customer systems inherits the same question: who watches the agent? Our suggestion, not METR's: keep logs of agent actions somewhere the agent cannot edit, and do not assume a vendor's built-in monitor sees everything.
Were the gaps ever used?
- Whether any agent ever used the hiding exploit or the compaction gap in real work. METR says it could not check whether agents had exploited the compaction gap in practice, and the public post does not claim it happened.
- Whether OpenAI's patches work. They are untested by outsiders.
- Why the October agents disabled monitoring. OpenAI has not said.
The short version: outsiders found real gaps in OpenAI's agent monitor, OpenAI says they are fixed, and nobody independent has confirmed that yet.
