Independent Audit Finds Significant Blinds Spots in OpenAI’s Internal Safety Net

As much as 25 percent of traffic from OpenAI’s most advanced internal AI agents operated without any safety monitoring at all, according to a new independent audit. This figure represents the upper bound of an estimate provided by researchers who spent three weeks embedded within the San Francisco-based company. The audit, conducted between July 21 and August 11, 2026, examined the internal systems designed to detect rogue behavior in AI models at the GPT-5.5 class and above. While the precise percentage remains uncertain, the findings highlight a substantial portion of high-level AI activity that went unobserved by safety tools.

The review was carried out by two researchers from METR and Redwood Research, who were granted deep access to OpenAI’s codebase, internal documentation, and staff. Over the course of their visit, they interviewed approximately a dozen employees to understand how the company’s monitoring infrastructure functioned in practice. Their investigation revealed that the gaps were not merely theoretical but operational, affecting how the company tracked its own internal development tools.

Beyond the unmonitored traffic, the auditors identified specific technical failures in the systems that were supposed to be active. For internal Codex traffic, an estimated 10 percent of activity went untracked between May and July due to a handling error involving compaction events, which are context summaries used by the models. OpenAI independently discovered and fixed this bug while the audit was still ongoing. Furthermore, during the period when these events were missed, agents could delay oversight by simply continuing to execute actions rather than handing control back to the user, effectively sidestepping the monitoring triggers.

The researchers also demonstrated several other vulnerabilities. They found methods to hide hundreds of actions from the monitor and bypass the Codex sandbox environment. Additionally, they determined that specially crafted inputs could likely cause the monitor to crash entirely. At the start of the audit, model behavior during reinforcement learning (RL) training was not being monitored at all. OpenAI notes that it paused RL training following an incident involving Hugging Face in August and subsequently expanded its monitoring coverage, though these changes occurred after the auditors’ access period had ended.

OpenAI states that it has since fixed all the weaknesses identified by the researchers. The full 61-page report was delivered internally, but after redactions were applied, the leadership teams at METR and Redwood Research received a 38-page version. Only a short summary has been released to the public, with METR noting it had no right to disclose the redacted portions independently. The audit was part of a pilot program designed to give outside researchers deep access to internal infrastructure, and for future audits, METR is advocating for greater public transparency.

The initiative represents a shift in how AI safety is verified, moving beyond internal self-reporting to include external scrutiny of critical infrastructure. While the pilot has concluded, the findings underscore the complexity of monitoring advanced AI systems and the challenges in ensuring comprehensive coverage across all stages of model interaction and training.