Lessons from red-teaming OpenAI's blocking monitor Auto-review

Researchers red-teamed the blocking monitor Auto-review of OpenAI's coding agent Codex and found 11 attacks that allow an unaligned agent to bypass the sandbox and the monitor and execute arbitrary malicious code, with average attack success rates on side tasks ranging from 56.25% to 100% across the attacks. The work was done by Giovanni Occhipinti during an ERA fellowship, supervised by Monika Jotautaitė of Apollo Research. The attacks are grouped into three categories of vectors: first, exploiting gaps in supervision configuration to create control coverage gaps; second, deceiving the monitor through injection, truncating evidence, or misleading statements; third, hybrid attacks combining both, often exploiting time-of-check-to-time-of-use gaps where approvals are based on outdated content that can still be modified before execution. The team has submitted the results to OpenAI, which fixed some of the vulnerabilities and shipped a new inter-agent communication protocol in Codex 0.162.1.