An external audit identified vulnerabilities that could allow OpenAI artificial intelligence agents to hide hundreds of recent actions from monitoring systems. The results were released on Thursday (22) by the organizations METR and Redwood Research, after an evaluation conducted between July 21 and August 11, 2026.
The researchers examined internal mechanisms designed to detect improper behavior by autonomous agents. Among the problems found, a vulnerability could allow Codex agents to bypass restrictions of the isolated execution environment, known as sandbox, and perform actions with the same permissions as the responsible user.
Another flaw could prevent the monitoring of hundreds of recent actions, including those involved in exploiting the vulnerability itself. The evaluators also identified two customer-controllable configurations capable of disabling supervision of new agents, although that procedure could be detected.
There is no evidence that agents have maliciously exploited these vulnerabilities in production. The evaluation investigated technical possibilities for bypassing the controls, not a confirmed incident of that nature.
The exercise involved one researcher from METR and another from Redwood Research. Both were given access to internal code, configurations, documentation, and interviews with approximately 12 professionals from OpenAI's technical teams. The work resulted in a 61-page internal report, but only a summary was released publicly, with the possibility of removal of information deemed sensitive by the company.
Audit examined historical systems, not current infrastructure
The results describe the monitoring system in place on July 21, before changes that OpenAI was developing during the evaluation period.
According to the researchers' estimates, between 75% and 94% of internal agent traffic through the Responses API, generated by models with capability equivalent to or greater than that of GPT-5.5, was eligible for monitoring. In the subset used by internal Codex agents, that proportion reached 99.2%.
Those percentages, however, do not represent the number of actions actually monitored. An eligible request could still fail to go through the complete supervision process due to errors, operational limitations, or implementation failures.
The evaluation also estimated that approximately 10% of the eligible traffic from internal Codex agents was not monitored between May and July 2026 due to the absence of inspection during context compaction events. The researchers acknowledged uncertainties in that estimate, because historical records did not allow the exact proportion to be calculated.
That specific flaw had already been identified by OpenAI itself before the audit began and was fixed during the exercise, according to the report.
After the evaluation, OpenAI said it had fixed all identified vulnerabilities that affected its protections in production. The company also told Reuters that the results helped strengthen its safeguards and guide future collaborations with independent evaluators.
However, the subsequent fixes did not undergo a new verification by the auditors. David Rein and Adam Kaufman, authors of the METR publication, explicitly stated: "We did not evaluate these claims."
Thus, the investigation documents limitations and circumvention possibilities in the historical system examined, but does not determine whether these vulnerabilities remain in the current infrastructure, nor does it offer independent validation of the subsequently announced fixes.
