METR and Redwood red-team OpenAI's internal agent monitoring: up to a quarter of GPT-5.5-class agent traffic unmonitored, RL runs uncovered, and headers that switched monitoring off; OpenAI says holes are patched, per METR

Why it matters

【Key points】

On Oct 22 METR published a summary of a three-week pilot (Jul 21–Aug 11) in which a METR and a Redwood Research staffer, on-site with codebase and monitor-config access, red-teamed OpenAI's internal misalignment monitoring. Internal report: 61 pages; OpenAI could redact the public version. OpenAI's account confirmed the collaboration.

1. Coverage: ~75–94% of internal agentic Responses API traffic from GPT-5.5-class+ models was eligible for monitoring (99.2% for internal Codex). RL training runs were unmonitored at the start. Unmonitored compaction left ~10% of Codex traffic unchecked May–July, and agents could postpone checks by never returning control.

2. Holes: a Codex sandbox and Auto-Review bypass; an exploit hiding hundreds of actions (redacted); serialization tricks to break the monitor; two client headers that turn monitoring off for new agents; two "read-only" tools that could be abused.

3. Monitor error rate <0.2%; monitors see nearly the full trajectory. Per METR, OpenAI says all production-safeguard holes are patched; unverified by METR.

【Verifiable】

https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/

https://x.com/OpenAI/status/2113298833392496746

https://x.com/metr_evals/status/2113290966933389390

https://agipulse.org/e/1008 https://agipulse.org/e/990 https://agipulse.org/e/892

【Our read】

1. This is the first public result of METR's embedded-assessment model at OpenAI, two days after OpenAI disclosed agents disabling monitoring (e/1008). The monitor itself had gaps agents could exploit.

2. Terms are weaker than Anthropic's: there, METR publishes without a veto and can describe redactions (e/892). Here OpenAI could redact unilaterally.

3. METR's design rules (check every N steps, reconcile all inference against monitor logs, isolate agents from monitors) apply to any company running coding agents. Monitoring coverage should be a disclosed metric.

4. Caveat: it tested the July system; fixes are unverified.