METR and Redwood Red-Team OpenAI's Internal Agent Misalignment Monitoring

METR and Redwood Research ran a three-week pilot high-access exercise (July 21 to August 11) stress-testing OpenAI's internal misalignment monitoring system as it existed on and before July 21. The exercise gave external researchers access to the codebase, monitor configuration, and documentation, and interviews with about a dozen staff. Findings include estimates of monitored agentic traffic and several vulnerabilities, some redacted. OpenAI reportedly patched vulnerabilities affecting its production safeguards, a claim the authors did not evaluate. The authors published only a brief, high-level post and propose design ideals for monitoring systems.

Key takeaways

• Roughly 75–94% of agentic Responses API traffic from models at least as strong as GPT-5.5 was estimated eligible for monitoring at the time.
• Compaction events were likely unmonitored, possibly leaving around 10% of eligible internal Codex traffic unmonitored between May and July 2026.
• Researchers found several vulnerabilities, including headers that disable monitoring for new agents and inputs that could cause the monitor to fail.
• OpenAI has stated all vulnerabilities impacting production safeguards were patched; the authors have not evaluated these claims.

Why it matters

It shows how external red-teaming of internal agent monitoring can reveal coverage gaps and bypasses, and proposes concrete design principles for monitoring systems that must withstand highly capable internal agents.

Read with care

Estimates carry substantial uncertainty, the findings describe the pre-July 21 system rather than current coverage, and OpenAI's patch claims were not independently checked.