Illustration of two people seen from behind at a desk with one laptop and a page of blacked-out lines, while a third person stands by the door of the glass-walled room. Beyond the glass, cards travel along a curving conveyor past a person at a checkpoint terminal.
AI-generated editorial illustration of accompanied outside reviewers examining a monitoring system on a company-issued device, with agent sessions flowing past a checkpoint. Conceptual scene; it does not depict METR, Redwood Research, or OpenAI staff or premises. Reuse license pending. Audit Commons (AI-generated editorial illustration) · Original AI-generated editorial illustration; reuse license pending

A Three-Week Pilot With On-Site Access

On October 22, 2026, METR published a post on a pilot exercise run from July 21 to August 11. One METR employee and one Redwood Research employee stress-tested OpenAI's internal misalignment monitoring system. Their 61-page report went to OpenAI researchers and security staff, and a 38-page version redacted by OpenAI went to METR and Redwood leadership. The public post is brief and high-level by prior agreement with OpenAI.

The pair could read OpenAI's internal codebase, monitor prompts and configuration, and internal documentation. They worked on OpenAI-issued devices that never left the premises and were accompanied while onsite. The findings describe the system on and before July 21; METR says OpenAI was expanding it during the exercise, so current coverage was not established.

Coverage Estimates and Bypass Routes

METR estimates that roughly 75 to 94 percent of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with substantial uncertainty in both directions, and 99.2 percent for the internal Codex subset. Eligible traffic is intended to reach a monitor, but load shedding, errors, or bugs could still keep some of it from review. Internal research inference traffic is excluded because of access and time limits.

  • Compaction. Not monitoring compaction events likely left on the order of 10 percent of eligible internal Codex traffic unmonitored from May to July 2026, with substantial uncertainty. Because the monitor triggered when an agent returned control to the user, an agent could postpone review during that period by continuing to act. METR could not check whether any agent did. OpenAI staff found the gap beforehand and fixed it during the exercise.
  • Training. Reinforcement learning training runs were not covered at the start, although staff said a subset of rollouts was monitored from March to June.
  • Bypass routes. METR reports ways Codex agents could in principle bypass Codex sandboxing and Auto-Review, an exploit that would keep hundreds of recent actions out of monitoring (details redacted by OpenAI), inputs likely able to make the monitor fail through serialization differences, and two client-controllable headers that disable monitoring for new agents, although setting them could itself be caught.
  • Checks that held. With minor exceptions the monitor sees the full trajectory the agent sees, and its prompts cover risks such as scheming, sabotage, data exfiltration, and prompt injection.

What OpenAI Says and What Is Unverified

METR reports that OpenAI has stated all identified vulnerabilities affecting its production safeguards have been patched, and that OpenAI has described significant later changes to intended monitoring coverage; METR has not evaluated either claim. OpenAI's August 18 and August 26 posts describe expanded monitoring requirements. None of the three OpenAI pages we read mentions this exercise or the patch statement, and a web search found no independent reporting.

OpenAI's March 19 post said less than 0.1 percent of traffic, mainly from bespoke or local setups, was outside monitoring coverage. METR's compaction estimate covers a later period and a different measure of traffic, so the figures cannot be compared directly.

Anthropic Comparison and Audit Questions

This exercise is separate from the arrangement in our report on Anthropic's employee-like access for METR. On October 15, Anthropic said it had onboarded six METR employees and that METR will publish its analysis; that post reported no findings. The OpenAI exercise was a time-limited pilot with two outside employees, and METR has published a summary of findings. METR's post does not mention the Anthropic arrangement; it points to its earlier three-week exercise with Anthropic. Redaction terms are described by different parties: METR says OpenAI could redact material it judged, "in its sole discretion", to be confidential or sensitive, while Anthropic says it decides what falls into predefined categories.

Our editorial questions: What share of eligible traffic was actually monitored once inference logs are cross-checked against monitor logs? METR endorses each finding presented but, unlike in some earlier engagements, had no unilateral right to describe redactions, so how can a reader tell whether redacted details change the picture? Did anyone retest the patches independently? See also Anthropic's METR access arrangement, METR's action-monitor review, and OpenAI's August training pause.