Outside Red Team Found Gaps in OpenAI's Monitor for Its Own Coding Agents

Two outside researchers were given three weeks inside OpenAI this summer to find holes in the system that watches its own AI agents, and the write-up they posted on 22 October lists several. According to the Redwood Research blog post, a METR employee and a Redwood employee worked from 21 July to 11 August, with access to the internal codebase, monitor prompts and configuration, documentation and interviews with about a dozen engineers.

The product was a 61-page internal report shared with OpenAI researchers and security staff. The public post is a short, high-level account, and OpenAI had the right to redact anything it judged sensitive, which the authors say they endorse.

What is the monitor supposed to do?

OpenAI described the system in March: it reviews agent sessions after they end, using GPT-5.4 Thinking to check tool use and reasoning against user intent and internal rules, and sends suspicious cases to human reviewers, IT Brief reported at the time. OpenAI said then that less than 0.1 percent of traffic fell outside monitoring.

What did the outside team find?

The red team estimated that 75 to 94 percent of agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with wide uncertainty, and 99.2 percent for the internal Codex subset. The largest gap involved compaction, when an agent condenses its own context. Not monitoring those events likely left about 10 percent of eligible internal Codex traffic unmonitored from May to July 2026, the authors wrote, though the exact share is uncertain because the needed data was not logged. OpenAI staff found the gap before the exercise began and fixed it during it.