Nonprofit evaluators METR and Redwood Research say they found several previously unknown weaknesses in OpenAI’s internal system for monitoring whether AI models behave in line with human interests and values. One exploit could let AI agents keep “hundreds” of recent actions from being monitored, the groups said.
The findings came from a pilot in which one employee from each organization received access to OpenAI’s codebase, documentation and some technical staff. The employees were chaperoned and used OpenAI-issued devices that stayed on the company’s premises.
What the evaluators tested
The three-week exercise ran from July 21 to August 11. METR and Redwood said they tested the monitoring system as it existed on and before July 21, while OpenAI was expanding it during the pilot. OpenAI told the evaluators it had patched the vulnerabilities affecting its production safeguards, according to the groups’ release.
The evaluators shared a 61-page report with OpenAI, but published only a high-level account. They said the pilot was not intended to provide robust public transparency about the monitoring system, and that they expect to share more detail about future exercises.
A test of outside access
The pilot also tested what it might look like to give independent researchers deep access to OpenAI’s systems. CEO Sam Altman pledged “employee-like access” for outside evaluators in September. OpenAI said earlier in October that it was finalizing contracts with third-party safety assessors.
The model for independent evaluation is still taking shape. The report does not publicly describe the vulnerabilities in detail, and the available account does not establish whether outside researchers independently verified that the fixes work.
Why it matters
For people relying on OpenAI’s safeguards, the pilot found that some recent agent actions could evade monitoring, while OpenAI says it has fixed the production-impacting weaknesses. The public summary does not provide enough detail to assess the fixes independently, so their effectiveness remains unclear.
