Red-Teaming OpenAI's Internal Agent Monitoring Systems
Source
metr.org
Date
Why it matters
Describes a pilot of external researchers with deep access testing an AI lab's agent monitoring, including coverage of monitored inference and subversion risk. A concrete model for auditing agent oversight.
Key takeaways · AI-distilled
METR and Redwood estimated that 75-94% of OpenAI's internal agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring at the time of the exercise, with substantial uncertainty. For internal Codex agents the estimate was 99.2%.
The monitor fired when an AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → returned control to the user and skipped context compactionSummarizing an agent's earlier conversation to free room in the context window so a long session can keep going.Full definition → events, so during that gap an agent could in principle postpone monitoring indefinitely by continuing to act. OpenAI had already found this and fixed it during the exercise.
The red team found two client-controllable headers that disable monitoring for new agents, a way Codex agents could in principle bypass sandboxAn isolated environment where AI-generated code or agent actions run without being able to touch anything real.Full definition → and Auto-Review, and likely monitor failures from serialization differences between what agents and monitors see.
Their design recommendations: check agents every N messages or minutes instead of at turn end, reconcile all inferenceRunning a trained model to get answers — the phase where AI is actually used, as opposed to trained.Full definition → logs against monitor logs, keep a list of known bypasses, and keep agents from influencing whether or when monitoring runs.
The findings cover the system as it stood on and before July 21. OpenAI says the vulnerabilities affecting production safeguards are patched and coverage has expanded, but METR has not evaluated those claims, and OpenAI could redact the public post.
Terms in this piece · Glossary
inference — Running a trained model to get answers — the phase where AI is actually used, as opposed to trained.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
context compaction — Summarizing an agent's earlier conversation to free room in the context window so a long session can keep going.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
