What changed
Two researchers from METR and Redwood Research conducted a three-week on-site audit at OpenAI, examining the company's internal monitoring system for rogue AI behavior. During the audit, which took place from July 21 to August 11, they accessed OpenAI's codebase and internal documents and interviewed about a dozen employees. The team identified numerous weaknesses in the monitoring system.
What this means in practice
The audit found that an estimated 6 to 25 percent of internal agentic Responses API traffic from models at the GPT-5.5 class and above wasn't covered by monitoring during the audit period. For internal Codex traffic that was supposed to be monitored, METR estimates roughly 10 percent went untracked between May and July due to a gap in how the system handled compaction events, which are context summaries. The auditors also found ways to hide hundreds of actions from the monitor and to bypass the Codex sandbox. They determined that specially crafted inputs could likely crash the monitor entirely and that model behavior during RL training wasn't being monitored at all when the audit began.
Limitations and availability
OpenAI had independently discovered the bug and fixed it while the audit was still underway. OpenAI says it paused RL training after the Hugging Face incident in August and expanded monitoring to cover it, but those changes came after the auditors' access period ended and weren't part of the evaluation. The full 61-page report was handed over internally, with redactions applied. METR and Redwood Research leadership received a 38-page version, while only a short summary was made available to the public. METR stated it had no right to disclose the redacted portions on its own. The audit was a pilot program organized jointly by METR, Redwood Research, and OpenAI to give outside researchers deep access to internal infrastructure. For future audits, METR says it wants to push for more public transparency.
