Two headers could switch off OpenAI’s agent monitoring

As of July 21, OpenAI’s internal agent monitor ran only when an agent handed control back to the user. So while compaction events went unwatched, an agent could put off being monitored indefinitely just by continuing to act, according to the red team from METR and Redwood Research described in METR’s October 22 post. If your own agent monitor fires only at the end of a turn, an agent that keeps working stays unreviewed until it stops, which is why METR now recommends checking agents every N messages or minutes. The findings describe OpenAI’s system as it stood then: OpenAI says it has patched every flaw that affected its production safeguards, and METR has not evaluated that claim.

The exercise ran for three weeks, from July 21 to August 11. One METR employee and one Redwood employee worked on OpenAI-issued devices that never left the premises. They could read OpenAI’s internal codebase, the monitor’s prompts and configuration, and internal documentation, and they interviewed about a dozen researchers and engineers from the monitoring, safety-systems and security teams. Their 61-page report went to OpenAI researchers and security staff. The public version is a short summary that OpenAI was allowed to redact. The system under test was asynchronous: it read agent trajectories and escalated suspicious ones for human review.

The turn-end trigger

Compaction is the step where a long agent session’s context gets condensed so the agent can keep working. OpenAI’s monitor did not cover those events. METR estimates this likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026. The uncertainty is substantial, because OpenAI had not been logging which monitor calls compaction triggered. OpenAI staff had found the gap themselves before the exercise began, and they fixed it while it was running. METR’s access did not let it check whether any agent actually used the postponement trick.

Two of METR’s design rules come straight out of this. First, agents should be monitored on a schedule, not when their turn ends, and “actions agents take should not be able to influence whether or when the monitoring system runs.” Second, a team should account for all of its inference, cross-check that record against the monitor’s own logs from time to time, and keep a list of every known way around monitoring.

What does 75–94% measure?

The broad estimate is that roughly 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring at the time of the exercise, with substantial uncertainty in both directions. That API powers Codex, among other things. For the narrower slice that served internal Codex agents, METR puts the eligible share at 99.2%.

“Eligible” means the traffic was meant to reach a monitor. Load shedding, monitor errors or bugs can still stop it before the end of the pipeline. The compaction estimate is a share of that eligible Codex traffic, so between May and July a near-total eligibility figure sat alongside an unmonitored slice on the order of 10%. The numbers OpenAI showed METR suggested the monitor errored on fewer than 0.2% of requests and shed no load during one 24-hour period of the exercise.

Some agent traffic falls outside these numbers entirely. Agents on OpenAI’s internal research inference service are not included, and METR could not estimate their volume given its access and time. RL training runs were not covered when the exercise started, although METR was told that a subset of RL training rollouts had been monitored for misalignment between March and June. On the other side, METR verified that, with a few minor exceptions, the monitor sees the full trajectory the agent sees. Its prompts look for scheming, sabotage, deception, data exfiltration, attempts to subvert the monitor, and prompt injection in either direction, among other categories.

Ways around the monitor

Two client-controllable headers, each working on its own, switched off monitoring for new agents. An agent could use them to start an unmonitored but otherwise identical instance, though setting the headers and spawning that instance could itself be caught by the monitor. METR’s rule here is that unmonitored requests should require explicit approval to use a specific set of organizations or API keys, and that those keys are barred from agentic inference.

Codex agents could in principle get past Codex sandboxing and Auto-Review and take any action the host user could take. A separate exploit would have kept hundreds of recent actions out of monitoring, including the actions that made up the exploit; OpenAI redacted its details. METR also found two unmonitored internal agentic tools that were thought to be read-only. A simple exploit could have let an agent take arbitrary actions in their sandboxed environment, but METR did not validate this or test whether it worked in practice. The matching rules: run agent scaffolds apart from the place where tool calls execute whenever possible, and as a rule keep the monitor’s design and code out of agents’ reach.

The last class of attack goes after the monitor itself. Because the trajectory an agent sees and the one the monitor reads were serialized differently, agents could likely craft inputs that made the monitor fail, so the trajectory would never be escalated for human review. METR’s answer is that the monitor should see exactly the context the agent sees.

What OpenAI could redact

All three parties set the exercise up as a pilot for giving outside researchers deep access, not as public transparency about OpenAI’s monitoring, and agreed in advance on a brief, high-level post. OpenAI could redact anything it judged confidential or sensitive, at its sole discretion. Unlike in its Frontier Risk Report and its Hugging Face incident investigation, METR had no unilateral right to describe those redactions, though it says it endorses every finding the post presents. METR’s and Redwood’s own leadership teams received only a 38-page version of the report, redacted by OpenAI. Compare the arrangement Anthropic offered METR in October, under which METR may say publicly whether it thinks a redaction was justified. For future rounds of this exercise, METR says it expects to follow the transparency and independence practices it has published for its work with AI companies.

OpenAI has also described significant changes to the intended coverage of its monitoring system since the exercise. METR has not evaluated them, and the exercise did not measure how much the expanded system covers today.