OpenAI audit reveals unmonitored traffic and vulnerabilities in AI safety systems

An on-site audit of OpenAI’s internal AI safety monitoring systems, conducted by researchers from METR and Redwood Research, revealed gaps in coverage and vulnerabilities that allowed actions to go undetected. While OpenAI claims to have addressed the issues, most findings remain undisclosed, raising questions about transparency in AI oversight.

Tarun Mottlia

Editor, Lazyfounder

Published Oct 24, 20264 min read

OpenAI audit reveals unmonitored traffic and vulnerabilities in AI safety systems — Image: METR via source

30 SEC SUMMARY

Two researchers from METR and Redwood Research conducted a three-week on-site audit at OpenAI to assess its AI safety monitoring systems.
The audit revealed 6 to 25% of internal agentic Responses API traffic from GPT-5.5 and above models went unmonitored.
Roughly 10% of internal Codex traffic was untracked between May and July due to a system gap.
Auditors found vulnerabilities allowing actions to be hidden, sandboxes bypassed, and monitors crashed.
OpenAI addressed some gaps during the audit but kept most findings confidential.

KEY HIGHLIGHTS

METR and Redwood Research auditors spent three weeks on-site at OpenAI assessing internal AI safety monitoring systems.
Between 6 to 25% of internal agentic Responses API traffic from GPT-5.5 and above models was not monitored during the audit.
Roughly 10% of internal Codex traffic went untracked between May and July due to a system gap in handling compaction events.
Auditors identified methods to hide actions from monitoring, bypass sandboxes, and crash the monitor.
OpenAI addressed some gaps during the audit, including expanding monitoring for RL training after an incident involving Hugging Face.
The full 61-page audit report remains mostly confidential, with only a summary released publicly.

Audit scope and findings

In July and August 2026, two researchers from METR and Redwood Research conducted a three-week on-site audit at OpenAI to evaluate its internal monitoring systems for rogue AI behavior. The audit focused on GPT-5.5 and later models, as well as Codex, OpenAI’s code-generation tool.

The audit uncovered significant gaps in coverage. Between 6 to 25 percent of internal agentic Responses API traffic from these models went unmonitored during the audit period. METR noted that the true figure could be higher or lower, given uncertainties in the data. Additionally, roughly 10 percent of internal Codex traffic between May and July was untracked due to a system failure in handling compaction events. OpenAI independently identified and fixed this issue while the audit was ongoing.

Vulnerabilities in monitoring systems

Auditors demonstrated methods to exploit weaknesses in OpenAI’s monitoring infrastructure. These included hiding hundreds of actions from the monitor, bypassing the Codex sandbox, and crafting inputs that could crash the monitoring system entirely. Such vulnerabilities could allow malicious or unintended model behavior to go undetected.

Model behavior during reinforcement learning (RL) training was also found to lack monitoring at the start of the audit. OpenAI expanded coverage in this area only after an incident in August involving Hugging Face, though these changes occurred after the auditors’ access period ended.

Confidentiality and industry implications

The full audit report spans 61 pages but remains largely confidential. METR and Redwood Research leadership received a 38-page redacted version, while only a short summary was released to the public. METR stated it had no authority to disclose further details independently.

The audit was part of a pilot program organized jointly by METR, Redwood Research, and OpenAI. METR has since signaled its intent to push for greater transparency in future audits, though the structure of such programs remains unclear.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This audit exposes systemic risks in how even well-resourced AI labs monitor advanced models. For founders and operators building on or competing with OpenAI’s platform, the gaps in coverage—particularly in agentic and RL training scenarios—signal that relying solely on a provider’s built-in safety systems may not be enough. The findings also underscore the need for independent audits, as OpenAI’s fixes came only after external scrutiny. Teams working on AI agents or enterprise use cases should treat monitoring as a core engineering challenge, not an afterthought, and budget for redundant safeguards.

Key takeaways

6 to 25% of internal traffic from GPT-5.5 and above models escaped monitoring, highlighting blind spots in AI oversight.
Vulnerabilities allowed actions to be hidden or sandboxes bypassed, posing risks for enterprises relying on these systems.
OpenAI’s decision to keep most findings confidential limits transparency, which could delay industry-wide improvements.
The audit’s focus on RL training gaps suggests operators using reinforcement learning should verify monitoring coverage independently.

Sources

The Decoder · 2026-10-23
Three-week on-site audit at OpenAI reveals major gaps in AI safety monitoring

This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.

About the author