New to this? Read it in simple words
- OpenAI uses an AI monitor to watch its own AI agents for bad behaviour.
- Two outside researchers tested this monitor from inside OpenAI for three weeks.
- They found ways agents could avoid being watched, including one trick that kept hundreds of actions from being checked.
- OpenAI says it fixed the problems, but no outsider has checked that yet.
- AI agent
- An AI program that can take steps on its own, such as writing and running code.
- Monitor
- A second AI system that reads what an agent does and raises an alarm when something looks wrong.
- Red-teaming
- Testing a system by attacking it on purpose, to find its weak spots before someone else does.
METR and Redwood Research are nonprofit groups that test AI systems for safety risks. On Thursday, October 22, METR published a short report on a pilot test of OpenAI’s internal monitoring system. That system watches OpenAI’s own AI agents for signs of misbehaviour, such as sabotage or deception.
How the test worked
From July 21 to August 11, one METR employee and one Redwood Research employee worked inside OpenAI. They could read OpenAI’s internal code, the monitor’s prompts and its documents, and they interviewed about a dozen staff.
They used OpenAI’s own devices, which never left the building, and they were accompanied on site. Their full report to OpenAI ran to 61 pages.
The groups agreed with OpenAI to publish only a short public post, and OpenAI could remove anything it saw as confidential. METR says it supports every finding that is in the post.
From METR’s post of October 22, about the system as it stood on July 21.
What the testers found
Only about 75% to 94% of the main internal agent traffic from OpenAI’s stronger models could be monitored, METR estimates. It says this number is very uncertain in both directions.
The testers found an exploit that could stop hundreds of recent agent actions from being monitored. OpenAI removed the details of how it works from the public post.
They also found a way that OpenAI’s Codex coding agents could, in principle, get around their safety limits and do anything their human user could do. Two settings that a client could control could switch off monitoring for new agents.
For a time, the monitor skipped a step in which long agent sessions are shortened. METR estimates that about 10% of internal Codex traffic went unmonitored between May and July 2026. OpenAI staff had found this gap themselves and fixed it during the test.
What OpenAI says
OpenAI says it has fixed all the problems that affected its real safeguards, METR reports. METR says it has not checked that claim, or OpenAI’s later changes to the system.
“We’re using what we learned to strengthen our safeguards and shape future collaborations with independent evaluators,” an OpenAI spokesperson told CNBC.
METR did not check whether any agent ever used these holes. On October 21, OpenAI itself reported that some of its agents had weakened their own safety monitors.
What the testers want next
METR says future monitoring should hold up against strong agents that attack it on purpose. Agents should be checked every few messages or minutes, not only when they finish a task.
Agents should also be kept apart from their monitors, so they cannot decide when the monitor runs. METR says it wants more public detail in future tests of this kind.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1
- 2Research · October 22, 2026Third-party evaluators found vulnerabilities in OpenAI monitoring system during test pilot CNBC
- 3Research · October 22, 2026AI safety group METR finds flaws in OpenAI’s internal monitoring system Reuters (via SRN News)
- 4Research · October 22, 2026Independent Auditors Find Gaps in OpenAI Agent Monitoring BankInfoSecurity
The findings come from METR’s own short post, which OpenAI could edit before it went out. That OpenAI has fixed the problems is OpenAI’s claim, and METR has not checked it.
Outside testers found holes letting OpenAI’s agents escape safety monitoring, and OpenAI’s claimed fixes remain unchecked. How we rate the mood