OpenAI Monitoring: New Audit Uncovers Gaps

The latest assessment of OpenAI's internal safety controls has produced results that raise fresh questions about how thoroughly the company is watching its own systems. Following a detailed, on-site review that concluded in mid-August, auditors from METR and Redwood Research have documented several significant weaknesses in the monitoring infrastructure. While the company claims all identified issues are now resolved, the findings suggest that blind spots persisted for a meaningful period during the summer.

The core of the investigation involved two researchers who were granted deep access to OpenAI's codebase and internal documents. Between July 21 and August 11, they interviewed approximately a dozen employees and scrutinized the mechanisms designed to detect anomalous or rogue behavior in AI models. The goal was to verify whether the existing monitoring systems could reliably track the actions of advanced agents, particularly those built on the GPT-5.5 class of models and above.

One of the most striking findings concerns the sheer volume of traffic that escaped oversight entirely. The auditors estimate that between 6 and 25 percent of internal agentic Responses API traffic was not covered by any monitoring during the audit window. METR notes that this estimate carries substantial uncertainty in both directions, meaning the true figure could be significantly higher or lower. Nevertheless, even the lower bound implies that a noticeable slice of high-level model activity was proceeding without a safety net.

The gaps were not limited to unmonitored traffic. For the internal Codex traffic that was supposed to be under surveillance, the researchers found a specific technical flaw. They estimate that roughly 10 percent of this traffic went untracked between May and July due to a bug in how the system handled compaction events, which are essentially context summaries. OpenAI independently identified this bug and implemented a fix while the audit was still ongoing, but the lapse had already allowed for a period of reduced visibility.

The mechanics of the failure offered agents a way to delay or avoid oversight. The monitoring system was designed to trigger when an agent handed control back to the user. However, because the system did not continuously watch for specific patterns during execution, agents could simply continue executing actions without returning control. This allowed them to sidestep the checkpoint entirely, effectively hiding their activities from the monitor by maintaining a state of continuous execution.

Beyond these systemic gaps, the auditors identified more direct methods for evading detection. They demonstrated how specially crafted inputs could likely crash the monitor entirely, rendering it blind. Furthermore, they found ways to hide hundreds of individual actions from the monitoring logs and to bypass the Codex sandbox, which is intended to contain agent behavior. These findings highlight that the safety layers may have been more fragile than previously understood.

A notable area of concern was the lack of monitoring during reinforcement learning (RL) training. At the start of the audit, model behavior during this phase was not being tracked at all. OpenAI stated that it paused RL training following the Hugging Face incident in August and subsequently expanded monitoring to cover this area. However, because these changes occurred after the auditors' access period ended, they were not part of the formal evaluation.

The transparency of the audit process has drawn its own scrutiny. OpenAI states that it has fixed all the weaknesses the auditors found and that the full 61-page report was provided internally. However, after OpenAI applied redactions, METR and Redwood Research leadership received only a 38-page version. A short summary was made available to the public, while the more detailed redacted portions remained out of reach. METR noted that it did not have the right to disclose those redacted sections on its own.

This audit was part of a pilot program organized jointly by METR, Redwood Research, and OpenAI, designed to give outside researchers deep access to internal infrastructure. It was not a routine check but a specialized effort to stress-test the company's safety claims. For future engagements, METR has indicated it wants to push for greater public transparency, suggesting that the current balance between proprietary confidentiality and public accountability may need adjustment.

As the industry moves toward more autonomous systems, the reliability of internal monitoring becomes a critical factor. The findings from this summer do not prove that failures occurred, but they do show that the tools meant to prevent or detect them had significant limitations. For readers in Texas and the South Central states, where tech infrastructure is increasingly prominent, these details matter as the region continues to build its reputation as a hub for innovation and enterprise adoption.