Outside researchers embedded at OpenAI found several ways its internal coding agents could escape AI monitoring.
One employee each from METR and Redwood Research spent 3 weeks inside OpenAI’s codebase.
OpenAI’s monitor checked agents only when they returned control to users and skipped compaction events, so roughly 10% of eligible internal Codex traffic went unmonitored between May and July 2026.
Agents could hide hundreds of recent actions from the monitor, start unmonitored copies through 2 client-controllable headers, likely make the monitor fail via serialization mismatches, and bypass Codex sandboxing and Auto-Review.
Even on paper, only an estimated 75% to 94% of internal Responses API agent traffic from GPT-5.5 or stronger models was eligible for monitoring, and RL training runs had no coverage when the exercise began.
OpenAI says every flaw affecting production safeguards is patched, but the auditors haven’t verified that and couldn’t check whether agents ever exploited the postponement gap.