External Review Finds Flaws in OpenAI’s AI Monitoring System

OpenAI’s internal system for monitoring AI had several weaknesses that could have allowed AI agents to avoid being watched, according to a test review by independent safety research groups METR and Redwood Research. The researchers found a possible way to keep hundreds of actions by AI agents out of monitoring systems. They also found a possible way for OpenAI’s Codex coding agents to get around security rules.

The review took place from July 21 to August 11, 2026. During this time, one researcher from each group worked at OpenAI’s offices and could access internal code, technical documents, monitoring settings and staff. The findings were published on October 22.

OpenAI said it had fixed all the weaknesses found in its active safety systems. However, METR and Redwood Research said they had not checked the fixes themselves. Their findings describe the monitoring system as it existed on or before July 21. They do not prove how secure or effective the larger system in use today is.

Outside Researchers Find Gaps in Monitoring

The test was designed to find out how well OpenAI watched its internal AI agents and whether someone could deliberately get around the systems that monitored them.

The researchers said they were given broad access to OpenAI’s internal systems. They examined source code, instructions used by monitoring systems and their settings. They also read internal documents and spoke with about a dozen researchers and engineers from teams working on monitoring, safety and security.

The review took place under controlled conditions. Both researchers used devices provided by OpenAI, kept those devices on company property and were accompanied while working at the offices.

The work produced a 61-page internal report that was shared with OpenAI’s researchers and security staff. The public received only a general summary. An agreement allowed OpenAI to remove sensitive information from what was made public.

AI Agents Could Have Hidden Hundreds of Actions

One major finding was a possible way for AI agents to stop hundreds of their actions from showing up in monitoring systems.

The researchers found weaknesses in the system that monitors actions in the background and checks them later. This system is meant to review what AI agents do and help spot actions that do not match their intended goals.

This kind of monitoring matters because AI agents can carry out many actions in a row, rather than just give a single text response. If an agent can prevent some of its actions from being checked, investigators may not get the full picture of what happened.

The published findings describe possible weaknesses in an older version of the system. They do not prove that the same method can still work in OpenAI’s current production system.

Codex Security Rules Also Examined

The researchers also found a possible way for OpenAI’s Codex agents to get around security rules and use the same permissions as the people using them.

This finding raises questions about how coding agents work in restricted environments, especially when they can use tools, files and other resources. Security controls must make sure that an agent’s ability to complete tasks does not automatically let it do things outside the limits it was given.

The researchers’ public summary did not prove that every weakness they found had been used in real-world operations. Instead, the review focused on finding ways the monitoring and control systems might be bypassed.

OpenAI Says It Has Fixed Production Weaknesses

OpenAI told the researchers that it had fixed all the weaknesses found in its active safety systems. The company also said the findings helped improve protections as its monitoring system grew.

However, METR and Redwood Research stressed that they had not tested or independently checked the fixes made afterwards. They also did not review every change introduced during or after the test.

This difference matters. Finding a weakness in an older system does not prove that the weakness still exists in the current version. In the same way, a company’s statement that it has fixed a problem is not the same as independent proof that the fix works.

OpenAI said the test would help guide future research projects with METR and other outside evaluators.

Independent AI Safety Checks Become More Important

The review shows why independent testing is becoming more important as AI systems get better at carrying out tasks that involve several steps.

Outside researchers can check technical safety measures without being part of the teams that built them. Giving researchers access to internal systems can help them find weaknesses that normal testing might miss.

However, these arrangements also bring challenges involving private information, intellectual property and the security of internal systems. In this test, OpenAI managed some of these risks by supervising the researchers on-site and requiring them to use devices that could not be taken off company property.

Limited Public Details Leave Questions Unanswered

The researchers gave OpenAI a detailed report, but the public received only a summary. The groups said this arrangement made the first test possible. They also said they expected future reviews to share more information with the public.

Because of these limits, people outside the company cannot check every technical detail or fully assess how OpenAI responded to the findings. More detailed public reports could help researchers understand which weaknesses were found, how they were fixed and what tests were carried out afterwards.

The researchers said future reviews should follow stronger rules for transparency and independence.

Monitoring Must Keep Up With AI Capabilities

The findings show that monitoring systems must be able to resist deliberate attempts by increasingly capable AI agents to avoid being watched. Good safety measures must do more than check whether a system works under normal conditions. They must also account for attempts to take advantage of technical weaknesses.

For OpenAI, the next steps include maintaining its expanded monitoring system, checking that security fixes work and continuing independent reviews. The test found weaknesses in an older version of the system, but it did not establish how well the current system works.

The main question is whether safety measures can reliably detect and limit what AI agents do, even when those agents have the technical ability to get around restrictions.