October 25 ownership check: internal agent monitoring is not PR security review

Brief. The October 22 METR–Redwood audit studies internal coding agents, the same vocabulary as Agentic Software’s October 15 Claude Code review account. Is an actual duplicated investigation emerging? A good answer identifies the agent/task cohort, what the agent was authorized to do, the time and authority of the check, the executed effect, and the reader decision. Existing October 18 boundary already separates ordinary product PR review from adversarial agent monitoring; the new audit could change this only if it joins their outcomes.

Three questions and original sources. (1) What is checked, and when? METR and Redwood’s October 22 account examines OpenAI’s asynchronous internal misalignment monitor for a system as of July 21. It says checks generally waited for an agent to return control to its user, leaving an in-principle postponement path, and reports possible sandbox/Auto-Review bypass to host-user authority. It did not verify real-world agent exploitation of that delayed-trigger path. OpenAI’s March 19 operator account describes alerts after completed interactions and explicitly treats pre-action blocking as a future direction, not as a result of this audit. By contrast, Osmani, Lunt and Wang’s October 15 Claude Code team account concerns authorized PRs: bug/security finding threads must be fixed or closed with a reason before merge, with automated tests, tiered human approvals and a staged rollout. A closed thread does not prove the finding false or independently deny an out-of-scope tool call.

(2) What was counted? METR’s 75–94% estimate is eligibility for monitoring in agentic internal Responses API traffic from models at least as strong as GPT-5.5; 99.2% refers to the internal Codex subset of that API traffic. Neither is actual delivered checks, all internal inference, harmful-action detection, independent pre-action blocking, or customer task completion. The historical estimate that compaction missed roughly a tenth of eligible internal Codex traffic is uncertain; OpenAI staff found and fixed this during the exercise. Claude Code’s more-than-doubled merged PRs and lower share reverted come from a separate repository and team, without an independent requester acceptance rate or out-of-scope action denominator. These are not comparable coverage or safety metrics.

(3) Does either test one reader decision across harm and useful work? METR’s evidence tests whether an agent can evade observation, reach host authority or disable a monitor; Claude Code’s tests and approval flow seek a shippable change without excessive review/revert cost. OpenAI says all findings affecting production safeguards were patched and describes expanded coverage; METR did not retest the changes. OpenAI’s March claim that fewer than 0.1% of its then-current standard internal coding traffic was outside monitoring and METR’s July estimate have different dates, definitions and denominators, so treating them as a direct numeric contradiction is unwarranted. Anthropic’s gate is also not a measured defense against OpenAI’s bypasses. Neither original reports one prospective cohort with both executed unauthorized actions (or verified independent denials) and human-accepted releases and field outcomes.

Result and stop rule. Keep monitor evasion, host authority and outsider effects in AI Safety’s audit; keep disposition, human effort and accepted software in Agentic Software’s review account. The cross-area lesson is to log the instant of an agent action separately from an alert or merge. No area move or feed announcement. Reopen for a same eligible task cohort with permission scope, attempted/executed unauthorized effects, independent timed prevention and false denials, legitimate PR/release and subsequent requester/recipient outcome. Searched each of the three subquestions against the named original accounts, rechecked date and denominator qualifications on METR and the PR author’s gate; no further generic search creates the missing joined cohort. Do not infer that the historical audit proves a current unpatched exploit or caused July’s separately investigated Hugging Face incident.