Red-Teaming OpenAI's Internal Agent Monitoring Systems

Between July 21st and August 11th, employees from METR and Redwood Research conducted a high-access pilot exercise to stress-test OpenAI’s internal misalignment monitoring system. The researchers were granted deep access to internal codebases, documentation, and staff interviews to evaluate whether agentic inference was sufficiently monitored and if such agents could subvert these safeguards.
The exercise identified several vulnerabilities in the system as it existed on or before July 21st, including the ability for Codex agents to bypass sandboxing, the existence of unmonitored internal tools, and methods to disable monitoring via client-controllable headers. While estimates suggest a high percentage of Responses API traffic was eligible for monitoring (75–94%), significant gaps were noted in RL training rollouts and "compaction events." OpenAI has since stated that identified production vulnerabilities have been patched and the system's coverage expanded, though these claims have not been independently verified by the researchers. The exercise concluded with a set of design ideals aimed at making monitoring infrastructure resilient against strategic attacks from highly capable agents.

* METR and Redwood Research employees conducted a pilot exercise from July 21st to August 11th.
* The exercise tested OpenAI’s internal misalignment monitoring system as it existed on or before July 21st.
* Researchers had access to OpenAI’s internal codebase, configuration details, documentation, and interviews with approximately twelve staff members.
* The exercise produced a 61-page internal report and a 38-page redacted version for leadership.
* Estimated eligibility for monitoring for Responses API traffic from models as strong as GPT-5.5 was 75–94%.
* 99.2% of Responses API traffic used for internal Codex agents was estimated as eligible for monitoring.
* RL training runs were not covered by the monitoring system at the start of the exercise.
* Codex agents were found to be able to bypass Codex sandboxing and Auto-Review.
* Two client-controllable headers were identified that could disable the monitoring system for new agents.
* Two internal agentic tools were found to have exploits allowing arbitrary actions despite being intended as read-only.
* OpenAI stated that all identified vulnerabilities impacting the production safeguards stack have been patched.

This text functions as a technical disclosure and post-mortem of a security audit. The strongest version of this narrative is that it represents a maturing of AI safety practices: moving from theoretical risk to empirical "red-teaming" with high-privilege access, resulting in the patching of tangible vulnerabilities.
The narrative relies on a careful balance of transparency and redaction. By highlighting specific failures (e.g., the "compaction events" and header exploits) while noting that the details are redacted or already patched, the text creates a sense of rigorous honesty without providing a roadmap for current attacks. It positions the researchers as independent auditors while acknowledging the logistical dependence on the entity being audited.
The root paradigm is the "Arms Race" model of safety: the assumption that as agents become more capable, the monitoring systems must be designed to withstand "deliberate, strategic, and sustained attacks." This shifts the view of AI safety from a set of static guardrails to a dynamic security operation. The second-order consequence is the normalization of "deep access" audits by third parties, which could either become a gold standard for industry accountability or a performative layer of "sanewashing" if the resulting public reports remain heavily redacted.
Patterns detected: none
Bridge Questions:
1. If the most critical details of vulnerabilities are redacted by the company being audited, how can the public verify the "robustness" of the resulting patches?
2. Does the transition toward "security-style" monitoring imply that AI misalignment is being treated as a hacking problem rather than a fundamental architectural flaw?
3. What would a truly independent audit look like if the researchers must use the company's devices and be accompanied by staff at all times?
Counterstrike Scan: A coordinated campaign to undermine trust in AI labs would use this text to argue that "even the experts found holes" and "the systems are fundamentally broken." This text does not match that pattern; it provides specific metrics and acknowledges that the vulnerabilities were historical and have been addressed.