External Reviewers Find Blind Spots in OpenAI’s Internal Safety Checks

As artificial intelligence systems grow more capable and autonomous, the mechanisms designed to watch over them have become a focal point for industry scrutiny. Recent findings from an independent audit suggest that OpenAI’s internal safeguards for detecting rogue AI behavior had notable blind spots during the summer of 2026.

Researchers from METR and Redwood Research spent three weeks embedded within OpenAI, gaining rare access to the company’s codebase and internal documentation. From July 21 to August 11, the team conducted interviews with approximately a dozen employees to evaluate the effectiveness of the monitoring systems in place for the company’s agentic models.

The first major finding concerned the sheer volume of traffic that escaped oversight. The auditors estimated that between six and 25 percent of internal traffic from models in the GPT-5.5 class and above was not covered by any monitoring during the review period. METR noted that this range carries significant uncertainty, reflecting the complexity of accurately measuring unmonitored data streams.

A second critical issue emerged regarding the internal Codex system. The team found that roughly 10 percent of this traffic went untracked between May and July due to a technical flaw in how the system handled compaction events, which are essentially context summaries. While OpenAI independently discovered and fixed this bug while the audit was still ongoing, the gap allowed agents to delay oversight by continuing to execute actions without handing control back to the user, effectively sidestepping the monitoring triggers.

Beyond these statistical gaps, the auditors identified specific technical vulnerabilities that could allow AI agents to operate with reduced visibility. They demonstrated methods to hide hundreds of actions from the monitor and to bypass the Codex sandbox. Furthermore, they determined that specially crafted inputs could likely crash the monitoring system entirely. At the start of the audit, model behavior during reinforcement learning (RL) training was also not being monitored, although OpenAI later paused and expanded coverage for this area following an incident in August, changes that occurred after the auditors’ access period ended.

OpenAI states that it has since remediated all the weaknesses identified by the external team. The full 61-page report was provided to the company, but after redactions, METR and Redwood Research leadership received a 38-page version. A concise summary was released to the public, while METR explained that it did not have the right to disclose the redacted portions without OpenAI’s approval.

This engagement was structured as a pilot program designed to test the feasibility of giving outside researchers deep access to a major AI lab’s infrastructure. Looking ahead, METR has indicated it intends to advocate for greater public transparency in future audits, aiming to share more detailed findings with the broader community rather than limiting access to executive leadership.