A three-week review of OpenAI’s internal AI safety monitoring found that some agent activity was not being observed, while other activity could evade or delay oversight. The audit examined internal systems and model behavior, but the public has access only to a short summary of the findings.
Some agent traffic was outside monitoring
Two researchers from METR and Redwood Research spent three weeks at OpenAI, from July 21 to August 11. They reviewed code and internal documents and interviewed about a dozen employees.
The team estimated that 6 to 25 percent of internal agentic Responses API traffic from models at the GPT-5.5 class and above was not covered by monitoring during the audit period. METR cautioned that this estimate has significant uncertainty in both directions, so it should be read as an estimate rather than a precise count.
The audit also identified a tracking gap involving internal Codex traffic. METR estimated that roughly 10 percent of traffic that was meant to be monitored went untracked between May and July because the system did not handle compaction events, or context summaries, as intended. That estimate also has significant uncertainty. OpenAI had found and fixed the bug while the audit was in progress.
Oversight could be delayed or evaded
The compaction issue was not the only concern. During the period when those events were not monitored, the system triggered oversight only when an agent handed control back to the user. An agent that kept executing actions could therefore delay that trigger.
Auditors also found ways to hide hundreds of actions from the monitor and bypass the Codex sandbox. They concluded that specially crafted inputs could likely crash the monitor entirely. These findings describe weaknesses identified during the review, rather than evidence that every possible route was used in practice.
Model behavior during RL training was not being monitored at all when the audit began. OpenAI says it paused RL training after the Hugging Face incident in August and expanded monitoring to include it. Those changes happened after the researchers’ access period ended, so they were outside the audit’s evaluation.
Fixes are reported, but public detail is limited
OpenAI says it fixed all the weaknesses the auditors identified. The full report was 61 pages and was shared internally. After OpenAI made redactions, leadership at METR and Redwood Research received a 38-page version; the public received only a short summary.
METR said it did not have the right to release the redacted material independently. That leaves readers with an account of the main findings but without the full detail needed to examine how each issue was tested, scoped, or resolved.
A pilot for future outside audits
The review was a pilot program organized jointly by METR, Redwood Research, and OpenAI. Its purpose was to give outside researchers deep access to internal infrastructure, an arrangement that can reveal operational weaknesses that may not be visible from the outside.
The findings show why monitoring needs to account for more than whether a system has a safety mechanism in place. Coverage, event handling, and the conditions that trigger review all shape whether oversight can see an agent’s activity in time. METR says it wants more public transparency in future audits, which could help readers understand both the evidence behind findings and the status of corrective work.