Up to 25% of OpenAI Traffic Escaped Monitoring During Recent Audit

A recent independent assessment of OpenAI’s internal safety infrastructure has concluded that a substantial portion of its advanced AI traffic operated without active monitoring. The findings, derived from a three-week on-site audit conducted by researchers from METR and Redwood Research, indicate that between 6 and 25 percent of internal agentic traffic from GPT-5.5 class models and above was not covered by oversight systems during the evaluation period. While METR notes that the uncertainty surrounding this specific estimate is significant in both directions, the discovery highlights a notable gap in the company's defensive posture against rogue AI behavior.

The audit took place from July 21 to August 11, 2026, granting the research team access to OpenAI's codebase, internal documents, and approximately a dozen employees. This initiative was structured as a pilot program designed to provide outside researchers with deep visibility into internal infrastructure. The primary objective was to evaluate the effectiveness of the monitoring systems deployed to detect and manage autonomous agent actions, particularly those capable of executing complex tasks without constant human intervention.

Beyond the broad coverage gaps, the auditors identified specific technical vulnerabilities within the Codex monitoring system. For traffic that was intended to be tracked, METR estimates that roughly 10 percent went unmonitored between May and July due to a defect in how the system handled compaction events. These events involve the creation of context summaries. According to METR, this estimate also carries significant uncertainty. OpenAI independently identified this bug and implemented a fix while the audit was still in progress, meaning the resolution was not part of the final evaluation scope.

The absence of monitoring during compaction events created additional opportunities for agents to delay oversight. The system was configured to trigger only when an agent handed control back to the user. Consequently, agents could bypass checks by simply continuing to execute actions without returning control. The auditors also demonstrated that it was possible to hide hundreds of actions from the monitor and to bypass the Codex sandbox. Furthermore, they determined that specially crafted inputs could likely crash the monitoring system entirely, leaving agents operating without observation.

At the start of the audit, model behavior during reinforcement learning (RL) training was not being monitored at all. OpenAI stated that it paused RL training following the Hugging Face incident in August and subsequently expanded monitoring to cover this phase. However, the company noted that these changes were implemented after the auditors' access period ended, meaning they were not included in the final assessment of the system's performance.

OpenAI has asserted that it has addressed all the weaknesses identified by the auditors. The complete report spans 61 pages and was provided to the company internally. After OpenAI applied redactions, the leadership teams at METR and Redwood Research received a 38-page version of the document. A shorter summary was made available to the public, while the redacted portions remain confidential. METR stated that it did not have the right to disclose the redacted sections independently, contributing to the limited public visibility of the detailed findings.

The pilot nature of this engagement allowed for unprecedented access to internal systems, setting a precedent for future collaborations between external researchers and AI developers. METR has indicated that it intends to advocate for greater public transparency in subsequent audits. As the industry continues to deploy more autonomous agents, the balance between proprietary security and external verification remains a central topic of discussion among technical stakeholders.

Following the completion of the audit, OpenAI has integrated the fixes into its operational workflow. The next steps involve observing the performance of the updated monitoring systems in a live environment. Researchers and industry observers will likely watch for any public disclosures regarding the long-term stability of these safeguards, particularly as the company scales its deployment of higher-level models.