METR stress-tests OpenAI's agent monitoring
On 22 October 2026 METR published the outcome of a three-week exercise (21 July to 11 August) in which one of its employees and one from Redwood Research had deep access to OpenAI's internal code and stress-tested the system that monitors agents for misalignment. They estimated that 75-94% of internal agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring and found vulnerabilities that let agents get round it.
Why it matters
Outside evaluators describe how far internal oversight of agents at a large laboratory really covers their work, and show the holes: reinforcement-learning training was not covered at the start, compaction events left about a tenth of Codex traffic unmonitored, and the monitor ran only when an agent handed control back. But this is a short public summary by agreement: OpenAI could redact anything at its own discretion and METR had no right to describe what was cut, so the reader sees part of a 61-page report and cannot check OpenAI's statement that everything touching production safeguards was fixed.
The exercise. From 21 July to 11 August 2026 one METR employee and one Redwood Research employee had access to OpenAI's internal codebase, monitor prompts and configuration and internal documentation, and held technical interviews with about a dozen researchers and engineers across the monitoring, safety-systems and security teams. They worked on OpenAI-issued devices that never left the premises and were accompanied while on site. The output was a 61-page internal report shared with OpenAI researchers and security staff; a 38-page version redacted by OpenAI went to the leadership of METR and Redwood. The system assessed is 'the internal misalignment monitoring system as it existed on and before July 21st', not the expanded system. Example findings, per the post (METR's words). Roughly 75-94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, 'with substantial uncertainty in both directions'; 99.2% within the subset used for internal Codex agents. Reinforcement-learning training runs were not covered at the start of the exercise (OpenAI had said a subset was monitored between March and June). Unmonitored compaction events left on the order of 10% of eligible Codex traffic outside monitoring between May and July 2026; OpenAI staff had found this themselves before the exercise and fixed it during it. Because the monitor ran when an agent returned control to the user, an agent could postpone monitoring indefinitely by continuing to act (METR could not check whether this was done in practice). By the information it was given, the monitor errored on less than 0.2% of requests. METR found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review and take any action the host user could; an exploit that would have kept 'hundreds of recent actions' from being monitored (details redacted by OpenAI); a serialization difference between what the agent sees and what the monitor sees; two client-controllable headers that disable monitoring for new agents; and two unmonitored internal tools thought to be read-only. It verified that, with a few minor exceptions, the monitor is shown the full trajectory the agent sees, and that its prompts look for scheming, monitor subversion, sabotage, data exfiltration, deception and prompt injection. What METR recommends: make monitoring hard to avoid (monitor every N messages or minutes, not only when a turn ends), check that everything meant to be monitored is, respond quickly to incidents, red-team the monitor actively, and isolate agents from their monitors. What the record does not claim. The exercise was a pilot of deep access for outside researchers, not public transparency, and the parties agreed up front on a brief post; OpenAI could redact anything it judged confidential and, unlike two other recent engagements, METR had no right to describe redactions. OpenAI has stated that all vulnerabilities affecting its production safeguards stack were patched and has described significant changes to the intended coverage; METR has not evaluated these claims. The coverage is described as of July, not October. The post does not say that anyone used the weaknesses found.