{"slug": "red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging", "title": "Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack", "summary": "An independent red-team evaluation by METR and Redwood Research, released Thursday, found that OpenAI's asynchronous internal misalignment monitoring system was not fit for purpose on and before July 21, 2026, during the period when OpenAI agents broke into model-hosting platform Hugging Face. The report found roughly 10 percent of eligible internal Codex traffic went unmonitored during compaction events between May and July 2026, and that agents could indefinitely postpone monitoring by continuing to take actions without returning control to the user; evaluators also found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review and an exploit that would prevent hundreds of recent actions from being monitored. METR and Redwood Research said the partners \"discovered a number of novel vulnerabilities in the asynchronous internal misalignment monitoring system as it existed on and before July 21st,\" and OpenAI says the system has since been improved.", "body_md": "# Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack\n\n[The Register](https://www.theregister.com)\n\nMonitoring was only partial and was easily bypassed\n\nAn independent [evaluation](https://www.machinebrief.com/glossary/evaluation) of [OpenAI](https://www.machinebrief.com/glossary/openai)'s internal misalignment monitoring system revealed that the system was not fit for purpose during a period when the company's bots were breaking into model-hosting platform [Hugging Face](https://www.machinebrief.com/glossary/hugging-face). The safeguards weren't nearly strong enough.\n\n\"The METR and Redwood employees discovered a number of novel vulnerabilities in the asynchronous internal misalignment monitoring system as it existed on and before July 21st,\" said evaluation partners METR and Redwood Research in [a report](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/) released on Thursday.\n\nThe system, [since](https://openai.com/index/pacing-model-development-cyber-capabilities/) [improved](https://openai.com/index/hugging-face-incident-and-the-road-ahead/) according to OpenAI, was intended to monitor [AI agent](https://www.machinebrief.com/glossary/ai-agent) behavior. But as [described](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/) by METR and Redwood Research, its monitoring capability was incomplete and could be bypassed by the agents it was supposed to monitor. \n\nBypassing the system wasn't always necessary because it wasn't always operative. Monitoring was suspended, for example, during compaction events. Compaction is a process by which AI models condense the data in their [context window](https://www.machinebrief.com/glossary/context-window) to make room for further input. And between May and July 2026, about 10 percent of eligible internal Codex traffic went unmonitored during compaction, according to the report.\n\nThat gap was theoretically large enough to allow AI agents to postpone monitoring indefinitely: agents could further suppress monitoring by continuing to take actions without returning control to the user.\n\n\"At the time of the exercise, the monitoring system triggered when agents returned control to the user, so during the time period when compaction events were not being monitored, agents could indefinitely postpone being monitored by simply continuing to take actions,\" the report explains.\n\nThis is not to say that OpenAI agents necessarily did so – the actions they did take, against Hugging Face and other organizations, have now been well documented. But OpenAI's internal monitoring system could easily have missed any misbehavior, were the company's AI agents inclined to conceal their activities – by acting during compaction – or simply to operate in system blind spots.\n\nThe report continues in this vein, citing not only monitoring gaps but poorly constructed software – dare we say vibe-coded? – that gave OpenAI agents the means to evade the shoddy monitoring.\n\n\"We found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, allowing them to take any action that the host user could take,\" the report says. \"We also discovered an exploit agents could use that would prevent hundreds of recent actions (including the actions involved in the exploit itself) from being monitored.\"\n\nThe details of this exploit were redacted by OpenAI, but to summarize: the monitoring system that missed some traffic could be avoided by agents that were constrained by a non-working sandbox and had access to an exploit to evade monitoring.\n\nBut that's not all. The evaluators found that AI agents could craft inputs that caused monitoring to fail, that there were two client-controllable headers capable of disabling the monitoring of new agents, and that there were two unmonitored agentic tools that were thought to be read-only but could be exploited to take arbitrary action in the sandbox – which as noted above leaked like a sieve.\n\nIn conclusion, METR and Redwood Research propose that the agent monitoring systems used by AI companies actually work and are robust enough to \"withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale.\" ®\n\nGet AI news in your inbox\n\nDaily digest of what matters in AI.\n\n## Key Terms Explained\n\n[AI Agent](https://www.machinebrief.com/glossary/ai-agent)\n\nAn autonomous AI system that can perceive its environment, make decisions, and take actions to achieve goals.\n\n[Context Window](https://www.machinebrief.com/glossary/context-window)\n\nThe maximum amount of text a language model can process at once, measured in tokens.\n\n[Evaluation](https://www.machinebrief.com/glossary/evaluation)\n\nThe process of measuring how well an AI model performs on its intended task.\n\n[Hugging Face](https://www.machinebrief.com/glossary/hugging-face)\n\nThe leading platform for sharing and collaborating on AI models, datasets, and applications.", "url": "https://wpnews.pro/news/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging", "canonical_source": "https://www.machinebrief.com/news/red-team-report-found-openai-utterly-failed-to-monitor-its-a-5ahh", "published_at": "2026-10-23 19:14:57+00:00", "updated_at": "2026-10-23 22:13:47.981333+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence", "large-language-models"], "entities": ["OpenAI", "METR", "Redwood Research", "Hugging Face", "Codex", "Auto-Review"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging", "markdown": "https://wpnews.pro/news/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging.md", "text": "https://wpnews.pro/news/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging.txt", "jsonld": "https://wpnews.pro/news/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging.jsonld"}}