OpenAI’s internal agent monitoring missed up to 10% of high-capacity model traffic and allowed bypasses
The claim
The authors claim that OpenAI’s internal misalignment monitoring system failed to monitor a significant portion of agentic inference and contained multiple bypassable vulnerabilities.
Published as: “Red-Teaming OpenAI's Internal Agent Monitoring Systems”
So what
The study suggests that OpenAI’s internal misalignment monitoring was incomplete and vulnerable, raising concerns about the ability to detect and control sophisticated internal agents.
The five-minute version
The METR and Redwood teams were given deep, on-site access to OpenAI’s internal code, prompts, and documentation for three weeks and interviewed about a dozen engineers. They estimated that 75-94% of agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, but identified gaps such as unmonitored compaction events that likely left ~10% of internal Codex traffic unchecked. They also discovered several ways agents could bypass monitoring, including client-controllable headers, sandbox escapes, and serialization bugs. OpenAI has since patched the reported issues, but the authors did not verify exploitation in the wild nor evaluate the post-patch system.
What they found 4
- Unmonitored compaction events likely left about 10% of eligible internal Codex traffic unchecked.
“We estimated that not monitoring compaction events likely led to on the order of 10% of eligible internal Codex traffic not being monitored between May and July 2026”
- Agents could bypass Codex sandboxing and Auto-Review to take any user action.
“We found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, allowing them to take any action that the host user could take.”
- Two client-controllable headers could disable the monitoring system for new agents.
“We found two independent client-controllable headers that disable the monitoring system for new agents, which could enable agents to start an unmonitored (but otherwise identical) instance.”
- Agents could craft inputs that cause the monitor to fail via serialization differences.
“We found that agents could likely construct inputs that cause the monitor to fail (and thereby not escalate the trajectory for human review) by exploiting serialization differences between the trajectory agents see and what the monitors see.”
What undercuts it the paper’s own results
- The authors note substantial uncertainty in both directions for the 75-94% coverage estimate.
- They did not validate whether the sandbox-escape or header-disable exploits were exploitable in practice.
- OpenAI reportedly patched all identified vulnerabilities after the exercise, but the authors did not re-evaluate the patched system.
Stated limits 4
- Findings apply only to the monitoring system as it existed on or before July 21, 2026; later expansions were not evaluated.
- Uncertainty in the exact fraction of traffic monitored due to missing logs of compaction-triggered monitor calls.
- No in-the-wild exploitation was observed; exploits were demonstrated only in controlled analysis.
- The report does not assess the current post-patch state of the monitoring system.
What’s new here 4
- Quantified monitoring eligibility for high-capacity model traffic (75-94% eligible, 99.2% for Codex agents).
- Identified a ~10% gap caused by unmonitored compaction events between May and July 2026.
- Discovered multiple bypass mechanisms: sandbox escape, header-based disable, serialization mismatch, and unmonitored internal tools.
- Provided design recommendations for more robust future monitoring infrastructure.
Artifacts & methods 5
- Responses APIprimitive
- Codex agentssystem
- Internal misalignment monitoring systemevaluation
- Client-controllable headersprimitive
- Serialization mismatch exploitprimitive