Auditors find up to a quarter of OpenAI model actions escaped internal checks

Two outside researchers estimated that as much as 25 percent of internal traffic for OpenAI's top-tier models bypassed the company's safety monitoring systems during a recent review. The audit, conducted by experts from METR and Redwood Research, took place over three weeks in July and August. Their findings suggest that a large portion of model activity was invisible to the internal controls designed to catch rogue behavior.

The audit focused on the GPT-5.5 class and higher models. The auditors estimated that between 6 and 25 percent of agentic Responses API traffic went unmonitored. METR noted that the uncertainty around this range is substantial in both directions. The team had access to OpenAI's codebase and internal documents and interviewed approximately a dozen employees during the pilot program.

A separate issue affected internal Codex traffic. The researchers calculated that roughly 10 percent of this traffic was untracked between May and July due to a bug in how the system handled compaction events. These events are context summaries that the monitoring system failed to process correctly. OpenAI identified the bug independently and corrected it while the audit was still ongoing.

The structure of the monitoring system also allowed agents to delay oversight. The monitor only triggered when an agent returned control to the user. If an agent continued executing actions without handing back control, it could avoid the check entirely. The auditors also found methods to hide hundreds of actions from the monitor and bypass the Codex sandbox environment.

The report stated that specially crafted inputs could likely crash the monitor completely. Additionally, model behavior during reinforcement learning training was not monitored at the start of the audit period. OpenAI paused this type of training after an incident in August and expanded monitoring to cover it. These changes occurred after the auditors' access ended, so they were not included in the evaluation.

OpenAI says it has now fixed all the weaknesses identified in the review. The full 61-page report was shared internally with the company. After redactions, the leadership at METR and Redwood Research received a 38-page version. A shorter summary was released to the public, with METR stating it did not have the right to disclose the redacted sections without permission. The organization said it wants to push for greater transparency in future audits.