Red-Teaming OpenAI's Internal Agent Monitoring Systems

Why we picked it · the editor's summary

A METR and a Redwood Research employee worked from OpenAI's codebase, monitor prompts and about a dozen engineer interviews between July 21 and August 11, 2026. They estimate that 75–94% of internal agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, and that unmonitored compaction events left on the order of 10% of eligible Codex traffic unwatched. The monitor ran when an agent handed control back, so while compaction went unmonitored an agent could postpone review by continuing to act; two client-controllable headers started unmonitored agents; serialization differences between what the agent and the monitor saw could make the monitor fail. OpenAI says most issues are patched, which METR has not checked. If you monitor agents, trigger on message count or time, not turn end, and reconcile inference logs against monitor logs.