METR and Redwood red-team OpenAI's internal agent monitoring system
Red-Teaming OpenAI's Internal Agent Monitoring Systems
From July 21 to August 11, METR and Redwood Research conducted a three-week high-privilege red-team pilot against OpenAI's internal misalignment monitoring system and produced a 61-page internal report. METR estimates that about 75%–94% of internal Responses API agent traffic from models at least as capable as GPT-5.5 is eligible for monitoring, and that this proportion is 99.2% for internal Codex agent traffic. They found multiple bypass paths, including that Codex agents could in theory bypass the Codex sandbox and Auto-Review, exploit serialization differences to make the monitor fail, use client-controllable request headers to launch new unmonitored agents, and cause hundreds of recent actions to go unmonitored. OpenAI said that vulnerabilities affecting the production defense stack have all been patched; METR did not evaluate this claim; these findings correspond to the system as of July 21 and earlier.
METR and Redwood publicly red-teamed OpenAI's internal monitoring system, providing coverage estimates and multiple bypass paths, which can serve as a reference for designing agent monitoring.