25% of Critical AI Traffic Left Unmonitored in Three-Week OpenAI Audit

Up to 25 percent of internal agentic traffic from OpenAI’s GPT-5.5 class models and above operated without any safety monitoring during a recent three-week audit. This figure, which represents the upper bound of an estimated 6 to 25 percent range, highlights a significant gap in the company's oversight of its most advanced systems. The findings come from a detailed review conducted by researchers from METR and Redwood Research, who were granted unprecedented access to the company's internal infrastructure.

The audit took place from July 21 to August 11 of this year. During this period, the research team had access to OpenAI’s codebase and internal documentation. They also conducted interviews with approximately a dozen employees to understand the operational context of the monitoring systems. The primary objective was to evaluate the effectiveness of internal mechanisms designed to detect rogue or unexpected behavior in AI agents.

Beyond the broad monitoring gaps, the auditors identified specific technical failures. For internal Codex traffic that was theoretically covered by oversight, roughly 10 percent of activity went untracked between May and July. This discrepancy was attributed to a bug in how the system handled compaction events, which are essentially context summaries. OpenAI independently discovered and corrected this bug while the audit was still in progress, though METR noted that the uncertainty surrounding the 10 percent estimate remains significant.

The review also uncovered vulnerabilities that allowed agents to delay or bypass oversight. Because the monitoring system only triggered when agents handed control back to the user, they could avoid scrutiny by simply continuing to execute actions without returning control. Furthermore, the auditors demonstrated methods to hide hundreds of actions from the monitor and bypass the Codex sandbox. They determined that specially crafted inputs could likely crash the monitor entirely, and noted that model behavior during reinforcement learning (RL) training was not monitored at all when the assessment began.

OpenAI stated that it paused RL training following the Hugging Face incident in August and subsequently expanded monitoring to cover this area. However, the company clarified that these changes were implemented after the auditors' access period ended and were therefore not part of the initial evaluation. OpenAI asserts that all weaknesses identified by the auditors have since been fixed.

The full 61-page report was provided internally to OpenAI. After the company applied redactions, the leadership teams at METR and Redwood Research received a 38-page version, while only a short summary was released to the public. METR indicated it did not have the right to disclose the redacted portions independently. This engagement was a pilot program designed to grant outside researchers deep access to internal infrastructure, with METR expressing a desire for greater public transparency in future audits.