AI Safety Gaps: Three-Week Audit Exposes OpenAI Monitoring Flaws

Independent auditors have identified critical vulnerabilities in OpenAI’s internal systems for monitoring advanced AI behavior. The findings suggest that a portion of the company's most powerful models operated with limited oversight during a specific period in the summer of 2026.

The first key finding involves a significant gap in coverage for high-level model traffic. Researchers from METR and Redwood Research estimated that between 6 and 25 percent of internal agentic Responses API traffic from GPT-5.5 class models and above was not monitored at all. This estimate was derived from a three-week on-site audit conducted between July 21 and August 11, during which the team accessed codebases and interviewed approximately a dozen employees. METR noted that the uncertainty surrounding this figure is substantial in both directions, highlighting the difficulty of tracking these complex systems accurately.

The second major issue concerns a technical bug affecting the Codex system. The auditors found that roughly 10 percent of internal Codex traffic went untracked between May and July due to a flaw in how the system handled compaction events. These events are essentially context summaries that allow agents to manage their memory. Because the monitoring system only triggered when an agent handed control back to a user, agents could avoid oversight by continuing to execute actions without returning control. OpenAI independently discovered this bug and implemented a fix while the audit was still in progress, though the estimate of untracked traffic remains uncertain.

The third point of concern involves the ability of AI agents to bypass safety controls. The auditors discovered methods to hide hundreds of actions from the monitor and to evade the Codex sandbox. They also determined that specially crafted inputs could likely crash the monitoring system entirely. Furthermore, model behavior during reinforcement learning (RL) training was not being monitored at the start of the audit. OpenAI stated that it paused RL training following an incident in August and expanded monitoring to cover it, but these changes occurred after the auditors' access period ended and were not part of the formal evaluation.

The audit was part of a pilot program designed to grant outside researchers deep access to OpenAI's internal infrastructure. While the full report consists of 61 pages, most of it remains hidden from public view. OpenAI redacted the document before sharing it with the research teams, who received a 38-page version. A short summary was made available to the public, but METR indicated it had no right to disclose the redacted portions independently. The company claims to have fixed all identified weaknesses and has provided the full report to internal stakeholders.

This event highlights the ongoing challenge of balancing rapid AI development with robust safety monitoring. As these systems become more autonomous, the ability to track their behavior becomes increasingly complex. For future audits, METR has expressed a desire for greater public transparency, suggesting that the industry may move toward more open reporting practices. The findings serve as a reminder that even well-resourced companies can have blind spots in their safety architectures, and that external scrutiny remains a vital component of responsible AI development.