News · 2026-10-23

METR and Redwood found ways around OpenAI’s internal agent monitor

METR and Redwood Research found vulnerabilities in OpenAI’s internal agent-monitoring system, including an exploit that could keep hundreds of recent actions out of monitoring. Their October 22 publication describes a July assessment of a historical system. OpenAI told the assessors it patched vulnerabilities affecting production safeguards, but the assessors did not evaluate that claim.

Key facts

• Two outside researchers conducted the exercise from July 21 to August 11, producing a 61-page internal report.
• The assessment covered the monitoring system as it existed on or before July 21.
• METR estimates that a separate compaction gap may have left roughly 10% of eligible internal coding-agent traffic unmonitored, with substantial uncertainty.
• Primary source: METR’s October 22 report.

A safety monitor is useful only if the activity it should inspect reaches it. That is the operational issue underneath this report. Monitoring is often discussed as a model’s ability to recognize bad behavior in a transcript. The exercise asks an earlier question: can an agent avoid producing a reviewable transcript at the right time, or interfere with the plumbing that sends it for review?

One employee from METR and one from Redwood received unusually deep access. They examined internal code, monitor instructions, configuration and documentation, and interviewed about a dozen researchers and engineers. They worked on OpenAI-issued devices that stayed on site. The matching Redwood account describes the same exercise, rather than a second independent replication.

OpenAI’s March description of its monitoring system provides background. The system inspected coding-agent interactions after completion, looking across conversation history, reasoning, tool calls and outputs to flag concerning behavior for human review. The assessors found instructions addressing deception, sabotage, data theft, interference with monitoring and malicious instructions arriving through external content. These were meaningful checks, but their value depended on when they ran and what they received.

The most striking finding is deliberately short on mechanics. METR says the exploit could “prevent hundreds of recent actions” from being monitored, including the actions involved in using it. OpenAI redacted the details. The assessors could not determine whether agents had actually used it. The finding therefore describes an evasion capability under the examined setup, rather than a count of confirmed incidents or proof that historical records were destroyed.

A separate issue involved compaction, the process of shortening an agent’s working context as a long session continues. At the time, the monitor ran when the agent returned control to the user. Compaction did not trigger it. An agent that kept acting could postpone review indefinitely while that gap existed. Think of a workplace inspection that happens only when an employee clocks out: extending the shift also delays the inspection.

METR’s estimate of the resulting missed traffic is uncertain because the necessary historical logging was absent. The approximately 10% figure is an estimate for eligible internal Codex traffic between May and July, rather than a measured fraction of every OpenAI interaction. OpenAI staff had independently identified that issue and fixed it during the exercise.

Eligibility also needs careful interpretation. A request configured for monitoring can still fail to complete the monitoring pipeline because of errors or other implementation problems. The assessors’ high eligibility estimate for internal coding-agent traffic does not establish that every eligible action was successfully inspected. This is the same distinction a security team makes between having a logging policy and possessing a complete, usable record.

The report’s recommendations follow from that mechanism. Monitoring should run periodically instead of waiting for an agent to end its turn. Agents should not control whether it runs. Owners should compare inference records with monitoring records, preserve tamper-resistant logs, assign incident ownership and repeatedly test the system under attack. Ground Truth’s lessons on agent scaffolding and sandboxing explain why these surrounding systems matter independently of the model’s intentions.

The access itself is a positive development, with a governance caveat. METR, Redwood and OpenAI jointly designed a high-access pilot. OpenAI retained redaction rights, and the researchers lacked a unilateral right to describe the redactions. Readers receive a limited public summary rather than the full internal report. The dossier establishes little substantive public reception beyond a small Reddit discussion, so it supports no claim of industry-wide consensus.

The strongest counterpoint is that these are historical findings from a system OpenAI was already expanding. Treating them as a description of current coverage would overreach. They still demonstrate why a monitor needs its own adversarial evaluation: a capable detector cannot protect an action stream it never sees. OpenAI’s separate October incident report makes that broader design question especially timely, without proving that the same exploit caused those incidents.

Primary source, verified: read the paper →

Ground Truth. (2026, October 23). METR and Redwood found ways around OpenAI’s internal agent monitor. Ground Truth. https://groundtruth.day/news/metr-redwood-found-gaps-in-openai-agent-monitoring.html

@misc{groundtruth:metr-redwood-found-gaps-in-openai-agent-monitoring,
  title  = {METR and Redwood found ways around OpenAI’s internal agent monitor},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/metr-redwood-found-gaps-in-openai-agent-monitoring.html}
}

Topics: cybersecurity · ai-security · red-teaming · agents · monitoring