METR and Redwood Research red-team OpenAI's internal agent misalignment monitoring system

METR and Redwood Research ran a three-week high-access exercise from July 21 to August 11 stress-testing OpenAI's internal misalignment monitoring system, producing a 61-page internal report. They estimated roughly 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, and 99.2% of the Responses API traffic used for internal Codex agents. The team found novel vulnerabilities, including a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, an exploit that could keep hundreds of recent actions unmonitored, and two client-controllable headers that disable monitoring for new agents; OpenAI says the vulnerabilities affecting its production safeguards stack have been patched, a claim the researchers did not evaluate.