AI agents could evade OpenAI monitoring, evaluators find

A pilot red-team review by METR and Redwood Research found ways agents could, in principle, bypass sandboxing or keep hundreds of actions from being monitored in OpenAI’s internal agent-monitoring system. The review examined the system as it existed on and before July 21, 2026—not its later changes. ^[1]

The evaluators said they identified an exploit that could prevent hundreds of recent actions from being monitored and a way Codex agents could bypass sandboxing and Auto-Review. They also estimated that roughly 75–94% of certain internal agent traffic was eligible for monitoring, with substantial uncertainty. ^[1] OpenAI told the evaluators that vulnerabilities affecting production safeguards had been patched, but METR said it did not assess that claim or establish the coverage of the expanded system. The exercise was a limited pilot, and the public account was a high-level summary of a private report. ^[1]