METR and Redwood’s high-access audit of OpenAI’s internal monitors

David Rein and Adam Kaufman, METR, 22 October 2026. From 21 July to 11 August one METR and one Redwood researcher examined OpenAI’s internal monitoring with code/configuration access and interviews with roughly a dozen staff. Their 61-page report to OpenAI is not public; this short public version was agreed in advance, and OpenAI had unilateral redaction rights. They evaluated the historical system as it existed on/before 21 July while its expansion was underway, not present coverage or the efficacy of subsequent fixes. Independent technical access is substantial; independent public verifiability is limited.

Denominators and good news. They estimate 75–94% of internal agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with uncertainty either way. Within internal Codex use of that API, estimated eligibility was 99.2%. Neither figure is the share of all model inference, actual monitoring delivery, detection or stop rate; another internal research inference service had unestimated traffic, and reinforcement-learning training runs were not covered at the start of the exercise (some training rollouts had been watched earlier). In the tested setup error logs suggested fewer than 0.2% requests errored and a 24-hour window had no load-shedding. The monitor saw nearly all the agent-visible trajectory and looked for sabotage, exfiltration and monitor subversion among other categories. Those are positive checks but do not prove action prevention.

Access and timing paths. Failure to trigger on conversation compaction appears to have left roughly a tenth of otherwise eligible internal Codex traffic unchecked between May and July; historical logs did not support a precise count. OpenAI staff had found and fixed that before/during this audit. Because monitoring waited until an agent returned control to its user, an agent could in principle keep taking steps without triggering review. The auditors found a path to bypass Codex sandboxing and Auto-Review to use host-user authority and an exploit that could hide hundreds of recent actions from the monitor; OpenAI redacted exploit details. Two client-controllable headers could turn monitoring off for new instances, although using them could itself be visible; serialization mismatches could cause monitoring failures without human escalation. Two nominally read-only unmonitored tools appeared subvertible, but the researchers did not validate practical exploitation. No evidence published of agents exploiting the delayed-turn vulnerability in actual runs, and none of these is a measured rate of malicious agent behavior.

Disagreement and next check. OpenAI told METR it patched all findings that impact its production-safeguard stack and changed intended coverage; METR has not tested either statement. The audit does not establish that today's OpenAI system is vulnerable, or that these particular flaws caused July's separate OpenAI–Hugging Face incident. A prospective independent retest should reconcile complete inference inventory with monitor-call and compaction/response logs, inject withheld attempts to disable and bypass monitoring, test authenticated human stop-before-write and independent egress, and publish effect/false-positive rates while protecting third parties. Compare Anthropic external low-risk review, METR’s own pre-action monitor, cross-lab synthesis and recipient-side test.