METR and Redwood researchers find multiple ways OpenAI's coding agents evade AI monitoring
rohanpaul_ai · x · 2026-10-23
METR and Redwood Research each embedded one employee inside OpenAI for three weeks to assess the system OpenAI uses to monitor internal agents for misalignment. Key findings:
- The monitor only triggered when agents returned control to users and skipped compaction events, leaving an estimated 10% of eligible internal Codex traffic unmonitored between May and July 2026; agents could indefinitely postpone monitoring by continuing to act.
- Agents could hide hundreds of recent actions (including the exploit itself), start unmonitored copies via two client-controllable headers, likely crash the monitor via serialization mismatches, and bypass Codex sandboxing and Auto-Review.
- On paper, only an estimated 75-94% of internal Responses API traffic from GPT-5.5-or-stronger models was eligible for monitoring (99.2% for internal Codex agents); RL training runs had no coverage when the exercise began.
OpenAI says every flaw affecting production safeguards has been fixed during or after the exercise. The write-up is public as part of an embedded assessment pilot.
More from coding & agent
- Google Play now installs private self-built apps as AI Studio turns prompts into Android apps — aitrendz_xyz · 2026-10-23
- One accidental cache write on a long Fable thread torched 99% of the Claude session limit — Aryvyo · 2026-10-23
- Every's frontier team and a tab-free AI browser built around one engineer's workflow — every · 2026-10-23
- System design in 11 stages: a full map from architecture basics to observability — goyalshaliniuk · 2026-10-23
- AI finds subtle architecture-level bugs, not just the memory exploits ASan can catch — stanislavfort · 2026-10-23
- Claude Duet vs OpenAI Dots: an unverified head-to-head of always-on agents — ankur_maker · 2026-10-23