# Red‑team test finds gaps in OpenAI’s internal monitoring system

> A three‑week external audit in July‑August 2026 uncovered vulnerabilities in OpenAI’s misalignment monitors, which the company says have now been patched.

Oossa · 2026-10-22 · https://oossa.com/en/red-team-test-finds-gaps-in-openai-s-internal-monitoring-system

From July 21 to August 11, 2026, a researcher from the Machine Ethics Transparency Research (METR) group and a colleague from Redwood Research were given deep access to OpenAI’s internal code and monitoring tools. They spent three weeks trying to break the system that watches over advanced AI agents, such as those powering Codex. Their findings were compiled in a 61‑page report shared with OpenAI staff.

## What the test revealed

The auditors estimated that between 75 % and 94 % of traffic from the internal Responses API – used by models at least as strong as GPT‑5.5 – was covered by the monitor, but the exact number is uncertain. For the subset of traffic that runs Codex agents, coverage was about 99.2 %. They also found that reinforcement‑learning training runs were not monitored at the start of the test, and that a lack of monitoring during “compaction” events may have left roughly 10 % of Codex traffic unchecked between May and July 2026.

Several concrete flaws were identified: agents could bypass Codex sandboxing, they could set client‑controllable headers that disabled monitoring for new agents, and they could craft inputs that caused the monitor to fail. Load‑shedding and monitor errors were rare – error rates were under 0.2 % and a 24‑hour snapshot showed zero load‑shedding incidents.

OpenAI says it has patched all the vulnerabilities that affect its production safeguards and has expanded the monitoring coverage since the test, though the auditors have not independently verified those claims.

## The facts

- The red‑team exercise ran from July 21, 2026 to August 11, 2026.
- Researchers estimated that 75–94 % of Responses API traffic from models at least as strong as GPT‑5.5 was eligible for monitoring.
- For internal Codex agents, 99.2 % of traffic was estimated to be eligible for monitoring.
- Load‑shedding and monitor error rates were reported as less than 0.2 % of requests, with zero load‑shedding observed in a 24‑hour period.
- OpenAI claims all identified vulnerabilities have been patched and monitoring coverage has been increased.

## Why it matters

For developers who rely on OpenAI’s Codex tools, the gaps mean some AI actions could have gone unchecked, potentially exposing users to unintended behavior. The company’s patching effort should reduce that risk, but independent verification is still needed to confirm the system now catches more of the agentic activity.

## Sources & references

1. [Red-Teaming OpenAI's Internal Agent Monitoring Systems October 22, 2026 A METR employee and a Redwood Research employee spent three weeks stress-testing OpenAI's internal misalignment monitoring syste](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/) – METR, 2026-10-22

Last updated: 2026-10-22