METR and other institutions found flaws in OpenAI's monitoring infrastructure, raising concerns about AI evading monitoring

METR and Redwood Research jointly investigated OpenAI's internal AI agent monitoring system and found multiple vulnerabilities that could bypass monitoring, but did not report actual misuse. The vulnerabilities include theoretical methods to bypass the Codex sandbox and automated review, a flaw that excludes the most recent hundreds of actions from monitoring, and an issue where a specific header can disable monitoring of new agents. A summary of the investigation was made public on October 22, 2026; two researchers accessed OpenAI's internal code and monitoring configurations over 3 weeks and interviewed about 12 security and safety personnel. The issue that session history compaction does not trigger monitoring may have left about 10% of target traffic unmonitored from May to July, and OpenAI fixed it during the investigation. OpenAI said it has fixed all known vulnerabilities affecting production environment safety protections and adjusted monitoring scope, but the two organizations did not verify this claim; the researchers recommend triggering monitoring at fixed times or message counts, checking monitoring records, and regularly testing the monitoring infrastructure from an attacker's perspective.