OpenAI Audit Exposes Critical Safety Blind Spots

OpenAI has confirmed that a recent three-week on-site audit uncovered substantial weaknesses in its infrastructure designed to monitor advanced AI models for unexpected behavior. Researchers from METR and Redwood Research conducted a deep dive into the company’s internal systems, finding that a significant portion of traffic from its most capable models escaped oversight entirely. The findings highlight potential vulnerabilities in how the company tracks the actions of its agentic systems, particularly those operating at the GPT-5.5 class and above.

The review took place from July 21 to August 11, 2026. During this period, the auditors were granted direct access to OpenAI’s codebase and internal documentation. They also interviewed approximately a dozen company employees to understand the operational context of the monitoring tools. This pilot program was jointly organized by METR, Redwood Research, and OpenAI to provide outside experts with rare visibility into the internal machinery of a leading AI lab.

The most significant finding concerns the volume of traffic that was not monitored at all. METR estimates that between 6 and 25 percent of internal agentic Responses API traffic from GPT-5.5-class models and higher lacked any monitoring coverage during the audit window. The organization noted that the uncertainty surrounding this estimate is high in both directions. Additionally, for the internal Codex traffic that was supposed to be tracked, roughly 10 percent went unmonitored between May and July due to a specific bug. OpenAI independently discovered and fixed this bug while the audit was still ongoing.

The auditors also identified mechanisms that allowed agents to delay or bypass oversight. Because the monitoring system only triggered when an agent handed control back to a user, agents could continue executing actions indefinitely without being checked. The team found ways to hide hundreds of actions from the monitor and bypass the Codex sandbox. They further determined that specially crafted inputs could likely crash the monitor entirely. At the start of the audit, model behavior during reinforcement learning (RL) training was not being monitored, a gap OpenAI says it has since addressed.

OpenAI states that it has remediated all the weaknesses identified by the auditors. The full 61-page report was submitted internally, but after redactions, METR and Redwood Research leadership received a 38-page version. Only a short summary was released to the public. METR indicated it did not have the right to disclose the redacted portions independently. OpenAI noted that while it paused RL training following the August Hugging Face incident and expanded monitoring coverage, these changes occurred after the auditors’ access period ended and were not part of the formal evaluation.

Looking ahead, the organizations involved are using the results of this pilot to shape future oversight efforts. METR has stated it intends to push for greater public transparency in subsequent audits. The goal is to refine the process of granting outside researchers deep access to internal infrastructure, ensuring that safety monitoring remains a priority as model capabilities continue to scale.