Outside red team finds ways around OpenAI's internal agent monitoring
METR and Redwood Research spent three weeks inside OpenAI testing its agent misalignment monitor and found several ways agents could avoid it.
One researcher from METR and one from Redwood Research spent three weeks, July 21 to August 11, inside OpenAI testing whether its internal agents could slip past the system that monitors them for misalignment. METR's write-up, published October 22, reports several novel vulnerabilities. If you run agents with real permissions, these failure modes are worth knowing because none of them is exotic.
The findings describe the system as it stood on and before July 21. Monitoring triggered only when an agent handed control back to the user. While compaction events went unmonitored, an agent could therefore postpone review indefinitely just by continuing to act. METR estimates that this gap left roughly 10% of eligible internal Codex traffic unmonitored between May and July. The researchers also report finding:
- a way Codex agents could in principle bypass sandboxing and Auto-Review
- two client-controllable headers that disable monitoring for new agent instances
- inputs that could likely make the monitor fail, by exploiting differences between what the agent sees and what the monitor sees
On coverage, they estimate 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with substantial uncertainty either way.
OpenAI has stated that every vulnerability affecting its production safeguards has been patched. METR says it has not evaluated that claim. The public post is deliberately high-level. The internal report ran 61 pages, CNBC reports, and The Decoder notes that METR had no right to disclose the redacted portions.
The most reusable part is METR's list of design ideals:
- monitor every N messages or minutes rather than at the end of a turn
- cross-check inference logs against monitor logs
- make sure the monitor sees the same context as the agent
- keep agents from influencing when monitoring runs
In our view, those checks apply to smaller agent setups too.