An on-site audit by researchers from METR and Redwood Research found substantial gaps in OpenAI’s internal monitoring for potentially dangerous agent behavior. The two auditors spent three weeks with access to code, documents and about a dozen employees between July 21 and August 11.
They estimated that 6% to 25% of internal agentic Responses API traffic from models in the GPT-5.5 capability range and above was outside monitoring during the review. METR stressed that the estimate is highly uncertain in both directions. It also estimated that roughly 10% of internal Codex traffic intended for monitoring went untracked from May through July because context-compaction events were not handled correctly.
The reviewers found ways to conceal hundreds of actions, bypass the Codex sandbox and potentially crash the monitor with crafted input. Reinforcement-learning behavior was not monitored when the audit began. OpenAI had independently found and fixed the compaction bug during the review and later expanded coverage after pausing training in August.
OpenAI says it has corrected every weakness in the audit. Public scrutiny is limited, however: the full report runs 61 pages, leadership at the outside organizations received a redacted 38-page version, and only a short summary was released publicly. The pilot shows the value of deep external access while also exposing how much transparency still depends on the company being audited.