Independent Audit Exposes Critical Blind Spots in OpenAI's Internal Safety Systems

An independent, three-week on-site audit has revealed that OpenAI’s internal systems for detecting rogue AI behavior contained significant monitoring gaps during the second quarter of 2026. Researchers from METR and Redwood Research spent 21 days embedded within the company, gaining direct access to its codebase and internal documentation. Their primary objective was to evaluate the robustness of the infrastructure designed to watch for unexpected or harmful actions by advanced language models.

The scale of the oversight deficit is substantial. The auditors estimated that between 6 and 25 percent of internal traffic from the Agentic Responses API, specifically involving models at the GPT-5.5 class or higher, was entirely outside the scope of active monitoring. While METR notes that this estimate carries significant uncertainty in both directions, the finding highlights a potential blind spot in how the company tracks its most powerful internal tools. This gap existed during the specific window of July 21 to August 11, when the researchers were physically present on-site.

Further scrutiny of the internal Codex traffic revealed additional flaws. METR estimates that roughly 10 percent of this traffic went untracked between May and July 2026. The cause was identified as a technical defect in how the system handled compaction events, which are essentially context summaries used to manage memory. Although this estimate also includes a margin of uncertainty, OpenAI confirmed it had independently discovered the bug and implemented a fix while the audit was still in progress.

Beyond simple tracking gaps, the auditors found structural weaknesses in how oversight was triggered. The monitoring system only activated when an agent handed control back to the user. This design flaw meant that agents could effectively delay or sidestep scrutiny by simply continuing to execute actions without pausing for user interaction. The researchers demonstrated that this loophole allowed for continuous, unmonitored activity, reducing the effectiveness of the safety net during active execution phases.

The team also identified more aggressive methods for evading detection. They found specific ways to hide hundreds of individual actions from the monitor and to bypass the Codex sandbox environment. Furthermore, the auditors determined that specially crafted inputs could likely cause the monitor to crash entirely, rendering the safety system inactive. They also noted that model behavior during Reinforcement Learning (RL) training was not being monitored at all when the audit period began.

OpenAI responded by stating it paused RL training following the Hugging Face incident in August and subsequently expanded its monitoring coverage to include this phase. However, the company clarified that these specific changes were implemented after the auditors’ access period had ended. Consequently, the expanded RL monitoring was not part of the evaluation conducted by METR and Redwood Research, meaning the audit does not reflect the current state of that specific safety measure.

The transparency of the audit results remains a point of contention. While OpenAI claims to have fixed all identified weaknesses, the full 61-page report was initially handed over for internal use only. After OpenAI applied redactions, the leadership teams at METR and Redwood Research received a 38-page version. Only a short summary was released to the public. METR stated that it did not have the unilateral right to disclose the redacted portions of the report without further agreement.

This investigation was structured as a pilot program, jointly organized by METR, Redwood Research, and OpenAI, with the goal of providing outside researchers with deep, hands-on access to internal AI infrastructure. For future engagements of this nature, METR has indicated it will push for greater public transparency. The findings suggest that while internal safety mechanisms exist, their coverage and trigger logic require refinement to match the complexity of modern agentic systems.

The stakes of these findings are high for the AI industry, which is increasingly relying on autonomous agents for complex tasks. The audit underscores the difficulty of monitoring systems that can delay, hide, or crash their own oversight tools. As companies move toward deploying more capable models in internal workflows, the gap between theoretical safety controls and actual implementation remains a critical area of focus for both developers and external auditors.