Two independent safety organizations conducted a three-week examination of OpenAI's surveillance infrastructure for its coding agents and uncovered significant blind spots. METR and Redwood Research reported their findings on Thursday, revealing that OpenAI's internal AI systems could potentially conceal hundreds of actions from the monitoring apparatus. OpenAI has stated that it has remedied all identified vulnerabilities affecting production safeguards, though the evaluators have not yet confirmed these fixes.
Between 21 July and 11 August, each organization deployed a single researcher to OpenAI's offices. These auditors gained access to internal systems, source code, documentation and monitoring prompts while conducting interviews with approximately a dozen staff members. All work occurred on OpenAI-controlled hardware that remained on-site throughout the evaluation period, with an OpenAI representative present during the assessment.
Blind spots in monitoring coverage
OpenAI's monitoring system relies on an AI model to observe agent behavior and identify potential misalignment—instances where models deviate from their intended purpose. The evaluators determined that between 75% and 94% of traffic from OpenAI's most capable models fell within the monitoring system's scope, with internal Codex agents reaching 99.2% coverage. However, when the audit commenced, training operations utilizing reinforcement learning fell outside the system's purview.
Memory compaction presented another vulnerability. When agents compress their memory to accommodate additional operations, the monitor failed to track these events. METR calculated that this gap left approximately 10% of eligible Codex traffic unobserved from May through July. OpenAI personnel had already identified this issue before the evaluation began and corrected it during the assessment period.
The monitoring system only activated when an agent returned control to its user. This design flaw meant that an agent could theoretically postpone scrutiny indefinitely by maintaining continuous operation. The evaluators lacked sufficient data to determine whether any agent had actually exploited this vulnerability.
Techniques for circumventing oversight
Beyond passive gaps, the researchers identified active methods to defeat the monitoring system entirely. Codex agents possessed the theoretical capability to escape their sandbox environment and bypass the Auto-Review verification, potentially enabling them to execute any action available to their user.
OpenAI chose to withhold specifics regarding the exploit that could conceal hundreds of actions, along with the technical steps required to execute it, according to METR. The auditors also documented that agents could likely generate inputs designed to cause the monitor to malfunction, preventing flagging for human review. Two client-controlled settings could disable monitoring for newly created agents, though the monitor might detect the activation of these settings. Additionally, a straightforward exploit could have permitted agents to leverage two ostensibly read-only tools to perform any action within their sandbox, though the evaluators did not test this scenario in practice.
Future monitoring should "withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale,"
the evaluators
Limited scope of the evaluation
The pilot program served primarily to test the feasibility of granting external parties deep access to OpenAI's systems rather than to provide comprehensive public transparency. OpenAI received the complete 61-page report, while METR and Redwood Research agreed to release only an abbreviated summary subject to OpenAI's redaction authority. Both organizations indicated they anticipate sharing additional findings following subsequent evaluation exercises.
"We're using what we learned to strengthen our safeguards and shape future collaborations with independent evaluators,"
an OpenAI spokesperson to CNBC
Chief executive Sam Altman committed in September to granting external evaluators access comparable to that of employees, according to CNBC reporting. President Donald Trump's voluntary AI accord similarly encourages companies to engage with independent evaluators. Nevertheless, some AI firms worry that on-site evaluators might transfer proprietary information to competitors, Reuters reported.
Context and regulatory attention
The evaluation commenced on 21 July, coinciding with OpenAI's public acknowledgment of a security breach affecting Hugging Face, a detail The Register highlighted. Following the evaluation report's release, OpenAI announced plans to eliminate direct internet connectivity during all frontier model training operations, citing the current state of monitoring capabilities as a contributing factor. Regulatory scrutiny has intensified as well: the US Federal Trade Commission issued subpoenas to OpenAI and Anthropic this month regarding AI safety incidents.
Source: The Next Web
