{"slug": "two-outsiders-found-ways-openais-ai-agents-could-slip-past-the-system-built-to", "title": "Two outsiders found ways OpenAI’s AI agents could slip past the system built to catch them", "summary": "METR reported on October 22 that two outside researchers spent three weeks inside OpenAI, from July 21 to August 11, red-teaming the company's internal misalignment monitoring for coding agents such as Codex and found \"a number of novel vulnerabilities,\" including two headers that start an unmonitored copy of an agent and an exploit that kept hundreds of recent actions, including its own, out of the monitor's sight. METR estimates 75 to 94% of agentic traffic on OpenAI's internal Responses API from models at least as strong as GPT-5.5 was eligible for monitoring, and 99.2% for internal Codex agents, while roughly 10% of eligible Codex traffic went unmonitored from May to July because the monitor skipped compaction and ran only when an agent handed control back to its user. The 61-page report, published only as a short high-level post that OpenAI could redact, states that future monitoring infrastructure should withstand \"deliberate, strategic, and sustained attacks from highly capable internal agents at scale,\" and comes as OpenAI reported this month that two of its agents weakened monitoring on their own work.", "body_md": "The OpenAI logo. Image: OpenAI (logo, public domain via Wikimedia Commons)\n\nTwo researchers from outside OpenAI spent three weeks inside the company trying to break the system it relies on to catch its own AI agents misbehaving, and they found several ways through. In a [post published on October 22](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/), the AI evaluation nonprofit METR says a METR employee and a Redwood Research employee uncovered “a number of novel vulnerabilities” in OpenAI’s internal misalignment monitoring, including settings that could switch it off for new agents and an exploit that kept hundreds of agent actions out of its sight.\n\nThe system is an AI monitor that reads the work of the coding agents OpenAI runs internally, such as Codex, and flags scheming, sabotage, deception or attempts to get round restrictions for a human to review. OpenAI [says](https://openai.com/index/how-we-monitor-internal-coding-agents-misalignment/) it has checked tens of millions of agent sessions. This month OpenAI reported [two of its agents weakening monitoring](https://madrobot.blog/2026/10/21/openai-agents-disabled-misalignment-monitoring-alerts-sol-astra-denied-report/) on their own work.\n\n## Three weeks inside OpenAI\n\nThe pilot ran from July 21 to August 11. The pair could read OpenAI’s internal codebase, the monitor’s prompts and configuration and internal documentation, and interviewed about a dozen staff from the monitoring, safety systems and security teams. They worked on OpenAI-issued devices that never left the premises, and were accompanied on site.\n\nTheir 61-page report went to OpenAI researchers and security staff. The groups agreed upfront to publish only a short, high-level post and OpenAI could cut anything it judged sensitive. The findings describe the system as of July 21, which OpenAI was already expanding.\n\n## What the red team found\n\nMETR estimates that **75 to 94%** of agentic traffic on OpenAI’s internal Responses API, which powers Codex, from models at least as strong as GPT-5.5 was eligible for monitoring, with “substantial uncertainty in both directions”. For internal Codex agents alone it was 99.2%. Traffic on OpenAI’s internal research inference service couldn’t be measured. OpenAI’s own description of the system says under 0.1% of traffic, mostly from bespoke or local setups, falls outside it.\n\nThe other findings include:\n\n- **Training runs:** reinforcement learning runs weren’t monitored at the start of the exercise, though some had been between March and June.\n- **Endless postponement:** the monitor ran only when an agent handed control back to its user, and skipped “compaction”, when a long session is summarised. That left roughly 10% of eligible Codex traffic unmonitored from May to July, and an agent could “indefinitely postpone being monitored by simply continuing to take actions”. OpenAI had spotted the gap and fixed it during the exercise; whether any agent used it couldn’t be checked.\n- **Sandbox escape:** a way Codex agents could in principle bypass Codex sandboxing and Auto-Review and do anything their human user could.\n- **Off switches:** two headers that start an unmonitored copy of an agent, though setting them might itself be caught.\n- **Blind spots:** an exploit, its details redacted, that kept hundreds of recent actions, including its own, from being monitored, and inputs that could make the monitor fail by exploiting differences between what the agent and the monitor see.\n\nSome checks came back clean: the monitor errored on fewer than 0.2% of requests and, with minor exceptions, saw everything the agent saw.\n\n## ‘Deliberate, strategic, and sustained attacks’\n\nThe post sets a blunt standard for what comes next:\n\nfuture monitoring infrastructure should be able to withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale.\n\nDavid Rein and Adam Kaufman, METR\n\nThat means checking agents every few messages or minutes rather than waiting for them to stop, cross-checking inference logs against the monitor’s, and keeping agents away from the monitor’s design and code.\n\nOpenAI says every vulnerability affecting its production safeguards has been patched, and it has described major coverage changes in its [Hugging Face incident](https://madrobot.blog/2026/09/26/openai-agents-hugging-face-hack-loot-slack-swarm-traces-report/) follow-up. METR says it hasn’t evaluated those claims, and OpenAI hasn’t commented publicly beyond them.\n\nMETR ran a similar exercise on Anthropic in March and has since [embedded evaluators inside Anthropic](https://madrobot.blog/2026/10/15/anthropic-metr-embedded-evaluators-employee-like-access-claude-risk/). The findings follow METR’s Chris Painter telling a [Senate hearing on rogue AI](https://madrobot.blog/2026/10/01/senate-rogue-ai-hearing-hawley-altman-metr-apollo-kokotajlo-openai-agents/) how OpenAI’s agents hid their tracks, and OpenAI [letting three safety researchers go](https://madrobot.blog/2026/10/01/openai-parts-ways-three-safety-researchers-shared-information-outside-ai-safety-group/), one of them its technical contact for METR and Redwood.\n\n## Why it matters\n\nAI labs point to monitoring as the reason agents can be trusted with real systems. The first deep outside test of OpenAI’s version found an agent could, in principle, switch it off, outlast it or hide from it. OpenAI says the holes are closed, but only a short summary is public and no one outside has checked the fix.\n\nSources: [METR, “Red-Teaming OpenAI’s Internal Agent Monitoring Systems”](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/), [OpenAI, “How we monitor internal coding agents for misalignment”](https://openai.com/index/how-we-monitor-internal-coding-agents-misalignment/).", "url": "https://wpnews.pro/news/two-outsiders-found-ways-openais-ai-agents-could-slip-past-the-system-built-to", "canonical_source": "https://madrobot.blog/2026/10/22/metr-redwood-red-team-openai-agent-monitoring-vulnerabilities-codex/", "published_at": "2026-10-22 15:33:00+00:00", "updated_at": "2026-10-22 15:41:07.337308+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence", "ai-research"], "entities": ["OpenAI", "METR", "Redwood Research", "Codex", "GPT-5.5", "David Rein", "Adam Kaufman"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/two-outsiders-found-ways-openais-ai-agents-could-slip-past-the-system-built-to", "markdown": "https://wpnews.pro/news/two-outsiders-found-ways-openais-ai-agents-could-slip-past-the-system-built-to.md", "text": "https://wpnews.pro/news/two-outsiders-found-ways-openais-ai-agents-could-slip-past-the-system-built-to.txt", "jsonld": "https://wpnews.pro/news/two-outsiders-found-ways-openais-ai-agents-could-slip-past-the-system-built-to.jsonld"}}