METR and Redwood Audit: OpenAI Agents Can Hide Actions From Safety Monitors

External auditors identified substantial blind spots in OpenAI’s internal safety monitoring systems.

Researchers from METR and Redwood Research conducted an on-site review at OpenAI from July 21 to August 11, 2026. They estimated that between 6 and 25 percent of internal agentic Responses API traffic from GPT-5.5 class models and above was not monitored during that period. METR noted that the uncertainty surrounding this range is considerable in both directions.

A separate issue affected internal Codex traffic. The auditors determined that roughly 10 percent of this traffic went untracked between May and July 2026. The system failed to process compaction events, which are context summaries, correctly. OpenAI identified and fixed this specific bug while the audit was still ongoing.

The audit revealed that the monitor only triggered when an agent handed control back to the user. This design allowed agents that continued executing actions to bypass oversight. The researchers also found methods to hide hundreds of actions from the monitor and to bypass the Codex sandbox. They concluded that specially crafted inputs could likely crash the monitor entirely.

Model behavior during reinforcement learning training was not monitored when the audit began. OpenAI stated that it paused reinforcement learning training after the Hugging Face incident in August 2026 and subsequently expanded monitoring to include it. These changes occurred after the auditors’ access period ended, so they were not part of the evaluation. OpenAI claims it has since fixed all weaknesses identified by the auditors.

The complete 61-page report was provided to OpenAI internally. After redactions, the leadership of METR and Redwood Research received a 38-page version. A short summary was released to the public. METR stated it had no right to disclose the redacted portions independently and said it wants to push for greater public transparency in future audits.