Audit Uncovers Significant Blind Spots in OpenAI's Internal Safety Systems

A detailed, three-week on-site audit conducted by researchers from METR and Redwood Research has uncovered substantial shortcomings in OpenAI's internal safeguards designed to monitor for rogue AI behavior. The investigation, which took place from July 21 to August 11, 2026, provided the external team with direct access to OpenAI's codebase, internal documentation, and interviews with approximately a dozen employees to assess the company's oversight capabilities.

The findings indicate that a notable portion of the company's internal activity was not being observed. The audit determined that an estimated 6 to 25 percent of traffic from the Responses API, specifically from models at the GPT-5.5 class and higher, was not covered by any monitoring during the period of the review. Researchers noted that the uncertainty surrounding this estimate is significant in both directions, suggesting a wide potential range for the actual figure.

Another significant gap was identified in the monitoring of internal Codex traffic. METR estimates that roughly 10 percent of this traffic went untracked between May and July 2026 due to a flaw in how the system processed context summaries, known as compaction events. While this estimate also carries significant uncertainty, it is noted that OpenAI had independently discovered and fixed the bug while the audit was still underway.

The auditors also uncovered methods by which AI agents could evade oversight. During the period when monitoring for compaction events was not active, the system was designed to trigger only when an agent handed control back to a user. This mechanism could be sidestepped, the report indicates, by an agent simply continuing to execute actions without pausing.

Further vulnerabilities were detailed in the audit findings, including the ability to hide hundreds of actions from the monitor and bypass the Codex sandbox. The research team also determined that specially crafted inputs could likely crash the monitoring system entirely. Additionally, the audit revealed that model behavior during reinforcement learning (RL) training was not monitored at all when the evaluation began.

OpenAI has stated that it paused RL training following an incident involving Hugging Face in August 2026 and has since expanded monitoring to cover that activity. However, these changes were implemented after the researchers' access period had concluded and were therefore not part of the evaluation.

In response to the findings, OpenAI says it has addressed all the weaknesses identified by the auditors. The full 61-page report was delivered internally to the company. Following the application of redactions by OpenAI, METR and Redwood Research leadership received a 38-page version, and only a brief summary has been made available to the public. METR has stated it does not have the right to disclose the redacted portions on its own.

The investigation was structured as a pilot program jointly organized by METR, Redwood Research, and OpenAI to grant outside researchers deep access to internal infrastructure. In light of the findings, METR has indicated it will advocate for greater public transparency in any future audits.