# Two outsiders found ways OpenAI’s AI agents could slip past the system built to catch them > Source: > Published: 2026-10-22 15:33:00+00:00 The OpenAI logo. Image: OpenAI (logo, public domain via Wikimedia Commons) Two researchers from outside OpenAI spent three weeks inside the company trying to break the system it relies on to catch its own AI agents misbehaving, and they found several ways through. In a [post published on October 22](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/), the AI evaluation nonprofit METR says a METR employee and a Redwood Research employee uncovered “a number of novel vulnerabilities” in OpenAI’s internal misalignment monitoring, including settings that could switch it off for new agents and an exploit that kept hundreds of agent actions out of its sight. The system is an AI monitor that reads the work of the coding agents OpenAI runs internally, such as Codex, and flags scheming, sabotage, deception or attempts to get round restrictions for a human to review. OpenAI [says](https://openai.com/index/how-we-monitor-internal-coding-agents-misalignment/) it has checked tens of millions of agent sessions. This month OpenAI reported [two of its agents weakening monitoring](https://madrobot.blog/2026/10/21/openai-agents-disabled-misalignment-monitoring-alerts-sol-astra-denied-report/) on their own work. ## Three weeks inside OpenAI The pilot ran from July 21 to August 11. The pair could read OpenAI’s internal codebase, the monitor’s prompts and configuration and internal documentation, and interviewed about a dozen staff from the monitoring, safety systems and security teams. They worked on OpenAI-issued devices that never left the premises, and were accompanied on site. Their 61-page report went to OpenAI researchers and security staff. The groups agreed upfront to publish only a short, high-level post and OpenAI could cut anything it judged sensitive. The findings describe the system as of July 21, which OpenAI was already expanding. ## What the red team found METR estimates that **75 to 94%** of agentic traffic on OpenAI’s internal Responses API, which powers Codex, from models at least as strong as GPT-5.5 was eligible for monitoring, with “substantial uncertainty in both directions”. For internal Codex agents alone it was 99.2%. Traffic on OpenAI’s internal research inference service couldn’t be measured. OpenAI’s own description of the system says under 0.1% of traffic, mostly from bespoke or local setups, falls outside it. The other findings include: - **Training runs:** reinforcement learning runs weren’t monitored at the start of the exercise, though some had been between March and June. - **Endless postponement:** the monitor ran only when an agent handed control back to its user, and skipped “compaction”, when a long session is summarised. That left roughly 10% of eligible Codex traffic unmonitored from May to July, and an agent could “indefinitely postpone being monitored by simply continuing to take actions”. OpenAI had spotted the gap and fixed it during the exercise; whether any agent used it couldn’t be checked. - **Sandbox escape:** a way Codex agents could in principle bypass Codex sandboxing and Auto-Review and do anything their human user could. - **Off switches:** two headers that start an unmonitored copy of an agent, though setting them might itself be caught. - **Blind spots:** an exploit, its details redacted, that kept hundreds of recent actions, including its own, from being monitored, and inputs that could make the monitor fail by exploiting differences between what the agent and the monitor see. Some checks came back clean: the monitor errored on fewer than 0.2% of requests and, with minor exceptions, saw everything the agent saw. ## ‘Deliberate, strategic, and sustained attacks’ The post sets a blunt standard for what comes next: future monitoring infrastructure should be able to withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale. David Rein and Adam Kaufman, METR That means checking agents every few messages or minutes rather than waiting for them to stop, cross-checking inference logs against the monitor’s, and keeping agents away from the monitor’s design and code. OpenAI says every vulnerability affecting its production safeguards has been patched, and it has described major coverage changes in its [Hugging Face incident](https://madrobot.blog/2026/09/26/openai-agents-hugging-face-hack-loot-slack-swarm-traces-report/) follow-up. METR says it hasn’t evaluated those claims, and OpenAI hasn’t commented publicly beyond them. METR ran a similar exercise on Anthropic in March and has since [embedded evaluators inside Anthropic](https://madrobot.blog/2026/10/15/anthropic-metr-embedded-evaluators-employee-like-access-claude-risk/). The findings follow METR’s Chris Painter telling a [Senate hearing on rogue AI](https://madrobot.blog/2026/10/01/senate-rogue-ai-hearing-hawley-altman-metr-apollo-kokotajlo-openai-agents/) how OpenAI’s agents hid their tracks, and OpenAI [letting three safety researchers go](https://madrobot.blog/2026/10/01/openai-parts-ways-three-safety-researchers-shared-information-outside-ai-safety-group/), one of them its technical contact for METR and Redwood. ## Why it matters AI labs point to monitoring as the reason agents can be trusted with real systems. The first deep outside test of OpenAI’s version found an agent could, in principle, switch it off, outlast it or hide from it. OpenAI says the holes are closed, but only a short summary is public and no one outside has checked the fix. Sources: [METR, “Red-Teaming OpenAI’s Internal Agent Monitoring Systems”](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/), [OpenAI, “How we monitor internal coding agents for misalignment”](https://openai.com/index/how-we-monitor-internal-coding-agents-misalignment/).