Two researchers from METR and Redwood Research spent three weeks inside OpenAI auditing the company’s internal monitoring system for rogue AI behaviour. From July 21 to August 11, they had access to the codebase and internal documents and interviewed about a dozen employees.
The team found numerous weaknesses. An estimated 6 to 25 percent of internal agentic Responses API traffic from models at the GPT-5.5 class and above was not covered by monitoring at all during the audit period, though METR says the uncertainty around that estimate is significant in both directions.
For internal Codex traffic that was supposed to be monitored, METR estimates roughly 10 percent went untracked between May and July because of a gap in how the system handled compaction events, which are context summaries. That estimate also carries significant uncertainty, according to METR. OpenAI had independently discovered the bug and fixed it while the audit was still underway.
During the period when compaction events were not being monitored, agents could also delay oversight because the system only triggered when they handed control back to the user. That meant agents could sidestep it by simply continuing to execute actions.
The auditors also found ways to hide hundreds of actions from the monitor and to bypass the Codex sandbox. They determined that specially crafted inputs could likely crash the monitor entirely and that model behaviour during RL training was not being monitored at all when the audit began.
OpenAI says it paused RL training after the Hugging Face incident in August and expanded monitoring to cover it, but those changes came after the auditors’ access period ended and were not part of the evaluation.
Most of the full report remains hidden from the public
OpenAI says it has fixed all the weaknesses the auditors found, and the full 61-page report was handed over internally. After OpenAI applied redactions, METR and Redwood Research leadership received a 38-page version, while only a short summary was made available to the public. METR said it had no right to disclose the redacted portions on its own.
The audit was a pilot program organised jointly by METR, Redwood Research, and OpenAI to give outside researchers deep access to internal infrastructure. For future audits, METR says it wants to push for more public transparency.
What it means
The people building these tools now know their safety nets have holes. During the three-week window, a chunk of traffic from advanced models simply went unseen. Agents could keep working without triggering alerts by refusing to stop. This leaves developers with a clear warning: the systems meant to catch runaway behaviour were not doing their job at the time, and fixing those gaps will require more than just patching a single bug.
