Redwood Research and METR red-team test OpenAI's internal agent monitoring system
Red-Teaming OpenAI's Internal Agent Monitoring Systems
Redwood Research and METR conducted a high-privilege red-team exercise against OpenAI's internal misalignment monitoring system from July 21 to August 11, finding multiple vulnerabilities that can bypass monitoring; OpenAI said issues affecting the production defense stack have been fixed. The test estimated that about 75%–94% of internal Responses API agent traffic generated by models at least as strong as GPT-5.5 can be monitored, and 99.2% of that API traffic used for the internal Codex agent can be monitored. Because compaction events were not monitored, about 10% of qualifying internal Codex traffic from May to July was not monitored, and OpenAI fixed this issue during the exercise. The test also found that the Codex agent could in principle bypass the sandbox and Auto-Review, and that there are paths to keep hundreds of recent actions unmonitored and to disable monitoring of the new agent via a client request header.
The test gives the proportion of internal agent traffic that is monitored, and lists multiple classes of vulnerabilities that can bypass monitoring; its design principles can be transferred to other monitoring systems.