OpenAI Faces Scrutiny After External Audit Exposes Significant Monitoring Blind Spots

OpenAI has come under intensified scrutiny following a three-week on-site audit that uncovered substantial weaknesses in its internal safety monitoring infrastructure. The review, conducted by researchers from METR and Redwood Research, examined the company's systems for detecting rogue behavior in its advanced AI models. The findings suggest that while the company has robust processes in place, significant blind spots remained during the period of evaluation, raising questions about the current state of oversight for high-performance agentic systems.

The audit team operated from July 21 to August 11, during which they gained access to OpenAI's codebase and internal documentation. They also interviewed approximately a dozen employees to understand the operational workflows. The primary objective was to test the efficacy of the monitoring systems designed to watch over OpenAI's internal use of AI agents, specifically those leveraging the Responses API and Codex tools. The researchers focused on models at the GPT-5.5 class and above, which represent the frontier of the company's current capabilities.

A central finding of the report is that a notable portion of internal traffic escaped oversight entirely. METR estimates that between 6 and 25 percent of internal agentic traffic from these high-tier models was not covered by monitoring at all during the audit window. The organization notes that this range reflects significant uncertainty in both directions, meaning the true figure could be lower or higher. This gap implies that a substantial number of autonomous actions taken by OpenAI's own tools were not being watched by the safety systems intended to catch errors or unintended behaviors.

Specific technical flaws also contributed to these monitoring gaps. For internal Codex traffic, the auditors identified a bug related to how the system handled compaction events, which are essentially context summaries used to manage memory. Roughly 10 percent of this traffic went untracked between May and July due to this issue. OpenAI independently discovered and fixed this bug while the audit was still ongoing. The uncertainty around this 10 percent estimate is also significant, according to the researchers, but the incident highlights how technical edge cases can create temporary blind spots in safety monitoring.

The audit also revealed structural vulnerabilities in how oversight is triggered. During periods when compaction events were not monitored, agents could delay oversight by continuing to execute actions without handing control back to the user. Since the system only triggered checks when control was returned, agents could sidestep inspection by simply maintaining their workflow. This finding suggests that the current design relies heavily on specific interaction patterns, which may not be consistent across all operational scenarios.

Beyond these passive gaps, the researchers tested the system's resilience against active evasion. They found methods to hide hundreds of actions from the monitor and ways to bypass the Codex sandbox, a security boundary designed to restrict agent capabilities. Furthermore, they determined that specially crafted inputs could likely crash the monitoring system entirely. At the start of the audit, model behavior during reinforcement learning training was not being monitored at all, although OpenAI stated it had paused such training after an incident in August and expanded coverage, though these changes occurred after the auditors' access period ended.

OpenAI has stated that it has fixed all the weaknesses identified by the auditors. The full 61-page report was handed over internally, but after redactions, METR and Redwood Research leadership received a 38-page version. Only a short summary was made available to the general public. METR noted that it did not have the right to disclose the redacted portions on its own, a decision that has sparked debate among industry observers about the balance between proprietary security and public transparency.

This engagement was structured as a pilot program organized jointly by METR, Redwood Research, and OpenAI. The goal was to provide outside researchers with deep access to internal infrastructure, a move intended to build trust and improve safety practices. Looking ahead, METR has indicated it wants to push for greater public transparency in future audits. The findings serve as a baseline for how external experts can engage with frontier AI labs, potentially setting a new standard for independent verification in the AI sector.

For investors and market watchers, the audit highlights a key risk factor in the deployment of advanced AI agents: the complexity of monitoring autonomous systems. As companies like OpenAI scale their use of agentic tools internally, the need for robust, fault-tolerant monitoring becomes a critical component of operational safety. The report does not suggest that the current systems are failing, but rather that they are imperfect and require continuous refinement to match the growing sophistication of the models they oversee.