What happened
- On October 22, 2026, METR published a summary of an exercise in which one of its employees and one from Redwood Research reviewed, between July 21 and August 11, the internal system OpenAI uses to watch its agents for misalignment.
- They had access to internal code, to the monitor’s prompts and configuration, and interviewed about a dozen engineers. The private report ran to 61 pages and OpenAI could redact what was published.
- Among the flaws, they found a way for Codex agents to escape their sandbox, a method to leave hundreds of recent actions unmonitored and two headers that switched the monitor off for new agents.
- METR estimated that between May and July roughly 10% of eligible internal Codex traffic went unmonitored because compaction events were not covered. OpenAI had already spotted this and fixed it during the exercise.
Why it matters
- The monitor is the net meant to catch an agent trying to sabotage or exfiltrate data. The flaws show that net had holes a capable agent could, in principle, find.
- For companies deploying their own agents, the recommendations work as a checklist: review every set number of messages, not only at the end of a turn, and keep the agent away from its monitor’s code.
- The format limits what is known: OpenAI had the right to redact and METR cannot describe what was removed.
The number
99.2%. Share of API traffic for internal Codex agents that was eligible for monitoring, according to METR.
Context
METR describes the exercise as a pilot for giving outside researchers deep access, not for full public transparency. It says it followed the format of an earlier exercise with Anthropic and that the monitor errored on under 0.2% of requests, according to the information it was shown.
What’s next
- METR says future versions will follow its own transparency and independence guidelines.
- OpenAI says it fixed the vulnerabilities affecting its production system. METR notes it has not evaluated those claims.
Bottom line
On October 20, METR had already questioned how Anthropic measured its models’ risk. And OpenAI proposed halting a training run if nobody answers an alert at night, a rule that depends on monitors like this one.
Sources
- METR — Red-Teaming OpenAI’s Internal Agent Monitoring Systems (October 22, 2026)
- The Verge — OpenAI’s misalignment monitoring system had a number of novel vulnerabilities (October 22, 2026)
- Cover image: Alan Levine from United States, CC BY 2.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
