Nonprofit AI safety organizations METR and Redwood Research on October 22, 2026 published findings from a three-week embedded pilot inside OpenAI, reporting several previously unknown vulnerabilities in the company's internal system for monitoring AI agents, including an exploit that could have allowed agents to prevent hundreds of recent actions from being tracked1,3,4.
OpenAI told the evaluators it has since patched the identified vulnerabilities that affect its production safeguards2.
What the pilot tested
The exercise ran from July 21 to August 11, 2026. One employee from each organization received high-access rights to OpenAI's internal codebase, misalignment-monitor prompts and configuration details, and internal documentation. The evaluators also conducted technical interviews with approximately a dozen researchers and engineers across OpenAI's monitoring, safety-systems, and security teams. They worked on OpenAI-issued devices that never left the premises and were chaperoned while onsite.
The pilot had two goals: estimating how much of OpenAI's agentic inference traffic its monitors actually cover, including traffic flowing through the Responses API and OpenAI's internal use of Codex, its coding agent, and finding weak spots in the monitoring system itself. The exercise was designed for OpenAI to test what it would look like to give external researchers a deep level of access to its internal infrastructure.
Coverage gaps and a 61-page report
For the Responses API, the assessment estimated that approximately 75% to 94% of traffic was monitored during the evaluation period. The evaluators produced a 61-page internal report shared with OpenAI researchers and security staff; a 38-page version redacted by OpenAI was shared with the leadership teams at METR and Redwood Research. METR and Redwood Research said they agreed to publish only a high-level public post about their findings because the pilot was not designed to provide robust public transparency about OpenAI's monitoring system.
The pilot follows OpenAI CEO Sam Altman's pledge to grant independent evaluators employee-like access to the company, and comes as OpenAI said it is actively finalizing contracts with third-party safety assessors. ANALYSIS The 75%–94% coverage estimate for the Responses API leaves a measurable share of agentic traffic unmonitored, a gap whose significance compounds alongside the severity of the exploit that could have hidden hundreds of agent actions from the same system.