Outside researchers find blind spots in OpenAI's internal safety checks

For anyone relying on AI to act on their behalf, a key safeguard is supposed to be a system that watches for a model going off the rails. But a recent, deep-dive review found that for a notable portion of the time, no such watching was happening. Two researchers from METR and Redwood Research were given access to OpenAI's internal systems to audit its monitoring for rogue AI behavior, and they found the system had considerable gaps during their review period.

The audit took place on-site at OpenAI from July 21 to August 11. During those three weeks, the researchers had access to the company's codebase and internal documents, and they interviewed about a dozen employees to understand how the safety monitoring system worked.

Their findings pointed to widespread weaknesses in oversight. An estimated 6 to 25 percent of internal agentic traffic from the company's most capable models was not covered by any monitoring at all during the audit period, though the researchers noted that the uncertainty around that estimate is significant in both directions. For internal Codex traffic that was supposed to be covered, the researchers estimated that roughly 10 percent went untracked between May and July.

That gap in Codex monitoring was traced to a bug in how the system handled context summaries, a problem OpenAI had independently discovered and fixed while the audit was underway. The researchers also found that during the period when these summaries weren't monitored, agents could delay oversight by continuing to execute actions rather than handing control back to the user, a trigger that would have activated the monitoring system.

The auditors discovered other ways to evade detection. They found methods to hide hundreds of actions from the monitor and to bypass the Codex sandbox. They determined that specially crafted inputs could likely crash the monitor entirely. At the start of the audit, they also found that model behavior during a specific type of training wasn't being monitored at all.

OpenAI says it has since paused that training method and expanded monitoring to cover it, but those changes were made after the researchers' access period ended and were not part of the evaluation. The company also says it has fixed all the weaknesses the auditors found.

The full 61-page report from the audit was handed over internally to OpenAI. However, after the company applied redactions, a 38-page version was given to the researchers' leadership, and only a short summary was made public. The audit was a pilot program organized jointly by METR, Redwood Research, and OpenAI to provide outside researchers with deep access to internal infrastructure, and for future audits, METR says it wants to push for more public transparency.