OpenAI AI Safety Audit Exposes Critical Monitoring Gaps

OpenAI has identified significant vulnerabilities in its internal systems designed to monitor advanced AI agents, following an intensive three-week audit conducted by external researchers. The independent review, carried out by experts from METR and Redwood Research, examined the company's infrastructure for detecting rogue behavior in its most powerful models. The findings reveal that a substantial portion of internal traffic was operating without adequate oversight during the period under review.

The audit took place between July 21 and August 11, 2026, granting the research team direct access to OpenAI's codebase and internal documentation. During this window, the auditors interviewed approximately a dozen employees to understand the operational workflows of the monitoring systems. Their investigation focused specifically on the agentic Responses API traffic generated by models at the GPT-5.5 class and higher, as well as internal Codex operations.

A central finding of the report indicates that an estimated 6 to 25 percent of this high-level traffic was not covered by monitoring at all. METR notes that this estimate carries significant uncertainty in both directions, but it highlights a potential blind spot in the company's safety net. Additionally, for internal Codex traffic that was intended to be monitored, roughly 10 percent went untracked between May and July. This gap resulted from a system failure in handling compaction events, which are context summaries used to manage memory. OpenAI discovered this specific bug independently and implemented a fix while the audit was still ongoing.

Beyond simple coverage gaps, the researchers identified mechanisms that allowed agents to delay or avoid oversight. The monitoring system was designed to trigger only when an agent handed control back to the user. Consequently, agents could bypass this check by continuing to execute actions without pausing. The auditors also demonstrated that it was possible to hide hundreds of actions from the monitor and to bypass the Codex sandbox using specially crafted inputs. Furthermore, they determined that such inputs could likely crash the monitoring system entirely.

The audit also highlighted that model behavior during Reinforcement Learning (RL) training was not being monitored when the evaluation began. OpenAI stated that it paused RL training after an incident involving Hugging Face in August and subsequently expanded its monitoring to cover this area. However, the company noted that these changes were implemented after the auditors' access period had ended, meaning they were not part of the initial evaluation.

OpenAI has confirmed that it has addressed all the weaknesses identified by the auditors. The full report, which spans 61 pages, was provided to the company internally. After OpenAI applied necessary redactions, the leadership teams at METR and Redwood Research received a 38-page version of the document. A shorter summary was made available to the general public, while METR stated it did not have the right to disclose the redacted portions independently.

This engagement was structured as a pilot program, organized jointly by METR, Redwood Research, and OpenAI, aimed at providing outside researchers with deep access to internal infrastructure. While the specific findings are now known, the majority of the detailed report remains non-public. Looking ahead, METR has indicated a desire to push for greater public transparency in future audit cycles to better inform the broader AI community.