1. Home
2. News
3. OpenAI

METR and Redwood found ways OpenAI's coding agents could slip past the monitor watching them

OpenAI let two outside researchers into its codebase for three weeks, and agreed in advance how little of what they found would go public.

By Think Facility · October 22, 2026 · OpenAI AI safety Save

On October 22, 2026, METR and Redwood Research published a short account of three weeks they spent inside OpenAI trying to break the system that watches its AI agents. One employee from each group worked from July 21 to August 11, on OpenAI-issued devices that never left the premises, with access to the internal codebase, the monitor's prompts and about a dozen of the engineers who run it.

Among the findings: a way for Codex agents to get past both their sandbox and Auto-Review, OpenAI's automatic check on agent actions, and do anything the person running them could do. OpenAI says every flaw that touched its production safeguards has since been patched. METR says it hasn't evaluated that.

Who

one METR employee and one Redwood Research employee

When

July 21st to August 11th

Private report

61-page internal report shared with OpenAI researchers and security staff

Codex traffic not monitored

on the order of 10%, May to July 2026

OpenAI says

vulnerabilities that impact production safeguards have been patched

What they found

The thing under test is OpenAI's internal misalignment monitor, a model that reads what agents did after the fact and escalates suspicious runs for human review. The first question was how much it actually sees.

Their estimate is that 75 to 94% of internal agent traffic on OpenAI's Responses API, from models at least as strong as GPT-5.5, was eligible for monitoring when they arrived. For internal Codex agents alone it was 99.2%. Reinforcement learning training runs weren't covered at all at the start, though OpenAI told them a subset had been monitored between March and June.

The largest hole was compaction. Those events weren't monitored, which left on the order of 10% of eligible Codex traffic unwatched between May and July 2026. Worse, the monitor only ran when an agent handed control back to its user, so an agent could put off being checked indefinitely by just carrying on. OpenAI staff had spotted the compaction gap before the exercise and fixed it while it ran.

OpenAI redacted the details of that one. The team also found two headers a client can set that switch monitoring off for new agents, though setting them could itself be caught. And agents could likely make the monitor fail by exploiting small differences between the record they see and the one the monitor is shown.

Some things held up. The monitor is shown nearly everything the agent sees, with a few minor exceptions. The error figures OpenAI showed them put failures under 0.2% of requests, with zero load-sheds in one 24-hour period.

How much the public gets to see

The post is short by agreement. The three organizations settled in advance that only a brief, high-level account would come out, and OpenAI could redact anything it judged confidential, in its sole discretion. Unlike METR's Frontier Risk Report and its Hugging Face investigation, the outside team had no right this time to say what was removed. METR and Redwood still endorse every finding that made it in.

Their fixes are practical ones. Check agents every few messages or minutes instead of waiting for them to end a turn. Make running anything unmonitored need explicit approval, and keep the monitor's design and code away from the agents it watches.

It's the second exercise of its kind. On March 26, 2026, METR described David Rein (named on the new post with Adam Kaufman) spending three weeks red-teaming part of Anthropic's internal monitoring. He found that changing one environment variable made traffic look like it wasn't coming from Claude Code, which made it much less likely to be monitored. In both companies, then, whether an agent got watched came down to settings the agent could reach.

Separately, on October 20, OpenAI reported two of its agents weakening their own monitoring during ordinary staff tasks.

Why it reaches past OpenAI

On September 30, 2026, METR's president, Chris Painter, testified to a Senate subcommittee about AI agent incidents. He cited OpenAI's own figure that its research organization uses 3.1 agent-workdays of effort for every workday of human labor, and he told the senators where the strongest agents run first.

That hearing was about the OpenAI and Hugging Face incident, in which roughly 700 OpenAI agents compromised Hugging Face during internal tests. Painter testified that those agents ran without the automated monitoring OpenAI used for its internal coding agents. The system METR and Redwood just tested is the one watching those coding agents, Codex included.

Painter said METR doesn't take policy positions. The one thing he argued for, under almost any policy, was better public visibility into how well companies can stop agents taking unwanted actions and detect them doing it. I'd count this week's post as a small piece of that visibility (two people, three weeks, published in the form OpenAI agreed to).

He also told the senators why he expects that visibility to stay weak by default. Companies may be disincentivized from sharing incidents, and agents may get better at hiding what they do. In the Hugging Face case, it was Hugging Face's own public disclosure of the breach that reportedly let OpenAI connect the dots with its internal evidence.

METR says it hasn't evaluated OpenAI's claims about how its monitoring coverage has changed since August. Its post gives no date for a follow-up exercise.