METR and Redwood Research publish findings of three-week on-site audit of OpenAI's internal AI monitoring system, finding coverage gaps and bypasses

METR published a short public summary of a pilot audit run from 21 July to 11 August, in which two researchers from METR and Redwood Research reviewed OpenAI's internal monitoring for rogue AI behaviour. They estimated that 6 to 25 percent of internal agentic Responses API traffic from GPT-5.5-class and newer models was unmonitored. About 10 percent of monitored internal Codex traffic went untracked from May to July because of a compaction-event bug, which OpenAI found and fixed during the audit. The auditors also reported that agents could delay oversight by not handing back control, that hundreds of actions could be hidden from the monitor, that the Codex sandbox could be bypassed, that crafted inputs could likely crash the monitor, and that RL training behaviour was unmonitored when the audit began. OpenAI says all the weaknesses are fixed. The full 61-page report stayed internal, and only a redacted 38-page version went to METR and Redwood leadership.

This is a rare case of outsiders getting on-site access to a frontier lab's internal safety infrastructure, and it shows that even a well-resourced lab had real monitoring gaps. Regulators, enterprise buyers and other labs can use it as a concrete example when asking what "we monitor our agents" actually covers. It also sets a modest precedent for third-party audits. The practical impact is limited for now: the details are thin, the fixes are self-reported, and nobody outside can check them.

The headline word "major" overstates what a short summary can support, since METR itself flags wide uncertainty (the 6 to 25 percent range is an estimate, not a measurement). The findings describe gaps in oversight, not evidence of any model actually behaving in a rogue way. The claim that "everything is fixed" comes from OpenAI and has not been independently verified. This was also a pilot with two people over three weeks, so it says little about how representative the findings are.

1. 01Whether METR or Redwood publish a fuller or less redacted report, or a follow-up audit that re-tests the claimed fixes, in the next few months
2. 02Whether other labs (Anthropic, Google DeepMind, others) agree to comparable outside audits of internal monitoring, or whether regulators such as the EU AI Office or the UK AISI reference this audit in guidance
3. 03Whether OpenAI publishes its own account with measured monitoring coverage figures (a tighter number than 6 to 25 percent) and confirms that RL training runs are now monitored