METR and Redwood Researchers Identify Critical Gaps in OpenAI's Internal Safety Monitoring

In an effort to increase external scrutiny of frontier AI development, independent researchers conducted an intensive review of OpenAI’s internal safety infrastructure. The findings, released this week, detail significant shortcomings in the company’s ability to track and monitor advanced model behavior during a specific period in the summer of 2026.

From July 21 to August 11, two researchers from METR and Redwood Research were granted on-site access to OpenAI. During this three-week window, the team examined the company’s codebase and internal documents while interviewing approximately a dozen employees. Their primary focus was auditing the systems designed to detect rogue or unexpected behavior in artificial intelligence models.

The audit uncovered substantial blind spots in coverage. METR estimates that between 6 and 25 percent of internal traffic involving agentic Responses API from models at the GPT-5.5 class and above was not monitored at all during the study period. Although the researchers noted significant uncertainty in this range, the gap suggests that a notable share of high-stakes internal interactions occurred without oversight. Additionally, for internal Codex traffic that was intended to be monitored, roughly 10 percent went untracked between May and July due to a system bug related to how compaction events, or context summaries, were handled. OpenAI independently identified and fixed this specific bug while the audit was still in progress.

Beyond coverage gaps, the auditors found that the monitoring system could be bypassed or obscured. Agents could delay oversight by continuing to execute actions rather than handing control back to the user, a requirement that triggered the monitoring system. The team also demonstrated methods to hide hundreds of actions from the monitor and bypass the Codex sandbox. They determined that specially crafted inputs could likely crash the monitor entirely. At the start of the audit, model behavior during reinforcement learning (RL) training was not being monitored, though OpenAI stated it paused RL training after an incident in August and expanded monitoring to cover it, noting these changes occurred after the auditors’ access period ended.

OpenAI has stated that it has corrected all the weaknesses identified by the auditors. The full 61-page report was delivered internally, but after redactions, leadership at METR and Redwood Research received a 38-page version. Only a brief summary has been released to the public, with METR noting it had no right to disclose the redacted sections independently. This initiative was a pilot program designed to grant outside researchers deep access to internal infrastructure, with plans for future audits to push for greater public transparency.

The findings mark a significant step in the ongoing dialogue between AI developers and independent safety researchers. By providing detailed, on-site insights into the mechanics of safety monitoring, the audit offers a rare glimpse into the operational challenges of managing advanced AI systems. As the industry moves forward, the balance between internal security and external accountability will likely remain a focal point for future regulatory and technical discussions.