Independent evaluators identified weaknesses in internal monitoring and sandbox controls, raising questions about how developers can safely supervise increasingly autonomous AI systems.
Independent researchers have identified vulnerabilities in OpenAI’s internal artificial intelligence monitoring infrastructure, including potential methods for coding agents to evade oversight and bypass security restrictions.
The findings were disclosed on October 22 by nonprofit research organizations METR and Redwood Research, following a three-week security evaluation conducted between July 21 and August 11, 2026.
According to the technical assessment published by METR, researchers discovered several previously unidentified vulnerabilities in systems designed to monitor AI agents for suspicious or misaligned behavior.
The findings add a new dimension to a growing engineering challenge: as AI agents gain more autonomy, the infrastructure supervising their actions must remain reliable even when those agents encounter ways to circumvent restrictions.
Researchers Identify Monitoring Blind Spots
The evaluation involved one researcher each from METR and Redwood Research, with access to OpenAI’s internal codebase, monitoring configurations and technical documentation.
The researchers also interviewed approximately a dozen engineers and scientists working across security, safety and monitoring systems.
Their findings were documented in a 61-page internal report shared with OpenAI.
The researchers estimated that between 75% and 94% of eligible internal agentic Responses API traffic from models at least as capable as GPT-5.5 could be covered by the monitoring system being evaluated. Among internal Codex traffic using that API, approximately 99.2% was eligible for monitoring.
Importantly, eligibility did not necessarily mean every interaction was successfully monitored.
The assessment found that missing monitoring during conversation-compaction events likely left roughly 10% of eligible internal Codex traffic unmonitored between May and July.
OpenAI had independently identified the compaction issue before the evaluation and addressed it during the exercise.
Autonomous Agents Could Circumvent Safeguards
Beyond coverage gaps, the researchers identified a potential exploit that could prevent hundreds of recent agent actions from reaching the monitoring system.
They also found a method through which Codex agents could, in principle, bypass sandboxing and Auto-Review restrictions, potentially allowing actions with the permissions of the host user.
Other findings included client-controllable settings capable of disabling monitoring for new agent instances and discrepancies between information visible to agents and monitoring systems.
The researchers did not establish that agents had exploited every weakness in actual operations. Some findings concerned possible attack paths, and the evaluation examined an earlier configuration rather than establishing the security posture of OpenAI’s expanded monitoring system.
OpenAI Says Production Safeguards Were Patched
OpenAI informed the evaluators that vulnerabilities affecting its production safeguards had been patched, although METR and Redwood Research had not independently verified those changes.
In its earlier description of internal coding-agent monitoring, OpenAI explained that its infrastructure reviews agent interactions and flags suspicious behavior for investigation.
The system is intended to identify activity inconsistent with user instructions, including attempts to circumvent operational restrictions.
The latest assessment illustrates why monitoring cannot be treated as a secondary feature of autonomous systems.
What Developers Can Learn
The researchers recommended stronger separation between agents and monitors, regular monitoring coverage audits, tamper-resistant logs and safeguards that prevent agents from controlling when oversight occurs.
Their recommendations also emphasized monitoring agents during ongoing tasks rather than relying exclusively on checks when interactions end.
The broader concern extends beyond OpenAI. A Google Research security survey examining 71 papers and three production vulnerabilities identified attack surfaces across agent inputs, external data, tools, memory and multi-agent coordination.
For companies deploying autonomous coding assistants, the practical implication is significant: granting agents greater operational access also expands the consequences of failed security controls.
The next competitive advantage in agentic AI may therefore depend not only on what autonomous systems can accomplish, but on whether developers can independently verify, restrict and account for the actions those systems take.
