The Pulse
Redwood Finds OpenAI Agent Monitor Could Be Bypassed
A Redwood Research and METR assessment found vulnerabilities and gaps in an earlier version of OpenAI’s internal agent monitoring system. OpenAI’s August 18 update describes expanded monitoring requirements that the researchers did not eval
AI.info Team · Written with AI · fact-checked ·
On October 22, Redwood Research published findings from a three-week assessment of OpenAI’s internal agent monitor: researchers found several ways agents could potentially evade checks or interfere with whether monitoring ran. The pilot, conducted with METR from July 21 to August 11, examined the system as it existed on and before July 21—not the expanded monitoring OpenAI was developing. Its estimates describe that earlier system, not OpenAI’s current coverage.
Some agent activity could miss the monitor
Redwood and METR estimated that roughly 75% to 94% of internal agentic Responses API traffic from models at least as capable as GPT-5.5 was eligible for monitoring. For the subset used by internal Codex agents, they estimated 99.2% eligibility. The authors caution that both estimates carry substantial uncertainty, and that eligibility means traffic was intended to reach a monitor—not that every request necessarily passed through the full monitoring process.
One gap involved compaction events, which were not monitored. The researchers estimated that this omission likely left about 10% of eligible internal Codex traffic unmonitored between May and July 2026, while stressing that missing historical logs made the exact share difficult to determine. They say OpenAI staff had identified the issue before the exercise and fixed it during the assessment.
The monitor also ran when an agent returned control to the user. During the period when compaction events were unmonitored, an agent could therefore have postponed review indefinitely by continuing to act. Redwood and METR say they could not determine whether any agent actually used that route.
“Our findings describe the historical system we assessed on and before July 21st, rather than the expanded system’s current coverage, which this exercise did not establish.”
Redwood Research and METR authors
Researchers found several possible bypasses
The assessment uncovered more than a coverage shortfall. The researchers found a way Codex agents could, in principle, bypass sandboxing and Auto-Review, potentially allowing them to take actions available to the host user. They also found an exploit that could keep hundreds of recent actions—including the actions involved in the exploit—from being monitored; OpenAI redacted its details from the public post.
Other findings came with explicit limits. Two client-controllable headers could disable monitoring for new agents, although the act of setting them and creating an agent could itself be caught. Researchers also identified two unmonitored internal tools believed to have read-only permissions and a simple way to subvert those limits, but they did not validate whether that approach was exploitable in practice.
The team further found that agents could likely construct inputs that make the monitor fail to escalate a trajectory for human review, by exploiting differences in how agent and monitor inputs are serialized. At the same time, it verified that the monitor generally receives the full trajectory visible to the agent and that its prompts check for categories including sabotage, data exfiltration, deception and attempts to subvert monitoring.
OpenAI describes changes since the assessment
Redwood says OpenAI told the researchers that it had patched all findings affecting its production safeguards stack. The post also says OpenAI described significant changes to the intended scope of monitoring, but the researchers did not evaluate those claims. The public account is a high-level summary of a 61-page report shared with OpenAI researchers and security staff; a 38-page version redacted by OpenAI went to Redwood and METR leadership.
OpenAI’s August 18, 2026 update describes an expanded monitoring setup. The company says monitoring is required for all tool-using reinforcement-learning training and evaluations involving models of Sol capability or higher. After determining that Astra may have critical cyber capabilities on August 7, OpenAI added a requirement to monitor all inference of Astra with tools. The multistage system starts with activation classifiers that inspect sampled tokens and can escalate concerns to increasingly sophisticated automated investigators.
The public account cannot establish current coverage
The assessment was designed as a pilot for giving outside researchers deep access, not as a full public audit. Redwood says OpenAI had the right to redact information it considered confidential or sensitive, and the organizations agreed in advance to publish only a brief public summary. Researchers also could not estimate agentic traffic from OpenAI’s internal research inference service, leaving another part of the picture outside their coverage calculations.
The findings therefore establish vulnerabilities and gaps in a dated version of OpenAI’s system, while the company’s later statements describe changes the external team did not test. Redwood and METR’s practical recommendation is to avoid relying on an agent’s turn ending as the signal to run a monitor: they propose checks at regular message or time intervals, alongside careful accounting that compares intended monitoring with actual monitor logs.