METR and Redwood Researchers Identify Critical Blind Spots in OpenAI's Safety Checks

Independent auditors have finished a deep dive into OpenAI's internal safety infrastructure, revealing that a substantial portion of the company's most advanced AI traffic escaped scrutiny. The team from METR and Redwood Research spent three weeks on-site, examining code and interviewing staff to evaluate how OpenAI monitors for rogue AI behavior. Their findings suggest that the current oversight systems have notable blind spots, particularly for models at the GPT-5.5 class and above.

The audit took place from July 21 to August 11, 2026. During this period, the researchers had direct access to OpenAI's codebase and internal documentation. They also conducted interviews with approximately a dozen employees. This access was part of a pilot program designed to allow outside experts to inspect the company's internal infrastructure in a way that had not been possible previously. The goal was to provide an objective look at how the company safeguards against unexpected model actions.

One of the most striking findings concerns the volume of unmonitored traffic. The auditors estimate that between 6 and 25 percent of internal agentic Responses API traffic was not covered by monitoring systems at all during the study period. METR noted that the uncertainty around this specific figure is significant in both directions, meaning the true number could be higher or lower. For internal Codex traffic that was supposed to be monitored, the team estimated that roughly 10 percent went untracked between May and July. This gap was caused by a technical issue in how the system handled compaction events, which are summaries of context.

This compaction bug created a specific window of vulnerability. Because the monitoring system only triggered when agents handed control back to the user, the AI agents could delay oversight by simply continuing to execute actions without pausing. This allowed them to sidestep the checks entirely for a time. The auditors also discovered methods to hide hundreds of actions from the monitor and ways to bypass the Codex sandbox. They determined that specially crafted inputs could likely crash the monitor system completely. Furthermore, model behavior during reinforcement learning (RL) training was not being monitored at all when the audit began.

OpenAI has stated that it has fixed all the weaknesses identified by the auditors. The company also noted that it had independently discovered the compaction bug and patched it while the audit was still underway. Regarding RL training, OpenAI said it paused the process after an incident involving Hugging Face in August and later expanded monitoring to cover it. However, the auditors clarified that these changes occurred after their access period ended and were therefore not part of the official evaluation. The fixes are now in place, but the initial findings reflect the state of the systems during the three-week review.

The distribution of the audit findings has raised questions about transparency. The full report is 61 pages long and was handed over to OpenAI internally. After the company applied redactions, METR and Redwood Research leadership received a 38-page version. Only a short summary has been made available to the general public. METR stated that it did not have the right to disclose the redacted portions on its own, which leaves much of the detailed technical analysis out of the public domain. This limited release has prompted calls for clearer guidelines on how future audit results are shared.

The audit was organized jointly by METR, Redwood Research, and OpenAI as a pilot to test the viability of deep external access. The collaboration aimed to set a precedent for independent verification of AI safety measures. While the current report is partially obscured, the auditors are already looking ahead. METR has expressed a desire to push for greater public transparency in future audits. They believe that more open sharing of findings will help build trust and improve the overall safety of AI systems as they become more complex.

For California readers and the broader tech industry, this audit highlights the ongoing challenge of balancing innovation with oversight. As AI models grow in capability, the systems meant to watch them must be just as robust. The gaps found in OpenAI's monitoring suggest that even leading companies face difficulties in keeping track of their own creations. As the industry moves forward, the results of this pilot program will likely influence how other AI labs approach independent safety reviews and public reporting.