METR (Model Evaluation and Threat Research) and the AI safety nonprofit Redwood Research published findings on 22 October 2026 from a red-team exercise against OpenAI's internal misalignment monitor. The monitor reviews what OpenAI's agents do for signs of sabotage, deception and other risks, and flags cases for human review. From 21 July to 11 August, an employee of each probed the monitor, as it stood on 21 July, for weaknesses.[1, 2]
They had access to OpenAI's internal code, documentation and the monitor's prompts and configuration, and interviewed about a dozen staff. Their 61-page report went to OpenAI, and a 38-page version redacted by OpenAI went to METR's and Redwood's leaders. OpenAI could cut anything it judged confidential or sensitive from the public summary, and METR had no unilateral right to describe the cuts.[1]
The testers estimate, with substantial uncertainty, that 75 to 94% of internal agent traffic on OpenAI's Responses API from models at least as strong as GPT-5.5 was eligible for monitoring. For internal Codex coding agents, the share was 99.2%. Eligible traffic is meant to reach the monitor, but errors or bugs could stop some. They estimate that a gap OpenAI staff found beforehand and fixed during the exercise likely left on the order of 10% of eligible Codex traffic unmonitored from May to July.[1]
The testers found that a client could switch off monitoring for new agents by setting either of two request headers, though the monitor could catch this. They also found an exploit agents could use to keep hundreds of recent actions unmonitored. According to METR, OpenAI has since said the vulnerabilities affecting its production safeguards are patched and described later changes to the monitor's intended coverage. "We have not evaluated these claims," the post says. It recommends reconciling records of all inference with the monitor's logs, keeping tamper-proof logs and isolating agents from their monitors.[1]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
0b24bf6b78210811e78b573b13791cf67d477987c2e06fcb48b3f45cf8af69bd
.jpg){kind=link}