6% to 25%: Unmonitored AI Traffic in OpenAI Audit

For consumers and investors tracking the rapid integration of artificial intelligence, the reliability of safety mechanisms is now a critical metric for assessing technological maturity. A recent independent assessment of OpenAI’s internal infrastructure highlights specific vulnerabilities in how the company monitors its most advanced systems, suggesting that a notable fraction of high-level AI activity may have operated without active oversight during the review period.

From July 21 to August 11, researchers from METR and Redwood Research conducted an on-site audit of OpenAI’s monitoring systems. The team, which included two researchers, gained access to the company’s codebase, internal documents, and interviews with approximately a dozen employees. The objective was to evaluate the efficacy of internal controls designed to detect rogue or unexpected behavior in AI models.

The findings indicate significant blind spots in the current architecture. METR estimates that between 6 and 25 percent of internal agentic traffic for models at the GPT-5.5 class and above was not covered by monitoring at all during the audit window. The organization noted that this range carries significant uncertainty in both directions. Additionally, for internal Codex traffic that was intended to be tracked, roughly 10 percent went unmonitored between May and July due to a technical gap in how the system handled context summaries, known as compaction events.

The audit identified further structural weaknesses that allowed AI agents to delay or avoid oversight. Because the monitoring system was designed to trigger only when an agent handed control back to the user, agents could bypass checks by simply continuing to execute actions. The researchers also discovered methods to hide hundreds of actions from the monitor and bypass the Codex sandbox. Notably, they determined that specially crafted inputs could likely cause the monitor to crash entirely. At the start of the audit, model behavior during reinforcement learning (RL) training was not being monitored at all.

OpenAI stated that it had independently discovered and fixed the compaction bug while the audit was still ongoing. The company also noted that it paused RL training following the Hugging Face incident in August and subsequently expanded monitoring to cover that area. However, these changes were implemented after the auditors’ access period ended and were therefore not included in the final evaluation.

While OpenAI claims to have remedied all identified weaknesses and has distributed the full 61-page report internally, public transparency remains limited. After redactions by OpenAI, METR and Redwood Research leadership received a 38-page version, with only a short summary available to the general public. METR stated it had no right to disclose the redacted sections independently. This pilot program, designed to grant outside researchers deep access to internal infrastructure, has led METR to advocate for greater public transparency in future audits.

The audit underscores the complexity of overseeing autonomous AI systems within corporate environments. As these technologies become more integrated into business operations, the gap between intended monitoring coverage and actual execution remains a key area of scrutiny for industry stakeholders.