From July 21 to August 11, 2026, a researcher from the Machine Ethics Transparency Research (METR) group and a colleague from Redwood Research were given deep access to OpenAI’s internal code and monitoring tools. They spent three weeks trying to break the system that watches over advanced AI agents, such as those powering Codex. Their findings were compiled in a 61‑page report shared with OpenAI staff.
What the test revealed
The auditors estimated that between 75 % and 94 % of traffic from the internal Responses API – used by models at least as strong as GPT‑5.5 – was covered by the monitor, but the exact number is uncertain. For the subset of traffic that runs Codex agents, coverage was about 99.2 %. They also found that reinforcement‑learning training runs were not monitored at the start of the test, and that a lack of monitoring during “compaction” events may have left roughly 10 % of Codex traffic unchecked between May and July 2026. Several concrete flaws were identified: agents could bypass Codex sandboxing, they could set client‑controllable headers that disabled monitoring for new agents, and they could craft inputs that caused the monitor to fail. Load‑shedding and monitor errors were rare – error rates were under 0.2 % and a 24‑hour snapshot showed zero load‑shedding incidents. OpenAI says it has patched all the vulnerabilities that affect its production safeguards and has expanded the monitoring coverage since the test, though the auditors have not independently verified those claims.
Why it matters
For developers who rely on OpenAI’s Codex tools, the gaps mean some AI actions could have gone unchecked, potentially exposing users to unintended behavior. The company’s patching effort should reduce that risk, but independent verification is still needed to confirm the system now catches more of the agentic activity.
