OpenAI Audit Uncovers Safety Gaps

Researchers from METR and Redwood Research identified substantial weaknesses in OpenAI’s internal monitoring infrastructure during a three-week on-site audit. The team examined how the company tracks and controls its most advanced AI models, finding that significant portions of internal traffic were not being observed as intended. This independent review offers a rare look at the internal safeguards used to manage potential rogue behavior in large language models, revealing that the current systems have notable blind spots.

The inspection took place from July 21 to August 11, 2026. During this period, the auditors had full access to OpenAI’s codebase and internal documentation. They also interviewed approximately a dozen company employees to understand how the monitoring tools were being used in practice. This deep dive was part of a pilot program designed to grant outside experts unprecedented visibility into the company's internal infrastructure, a step that both research firms and OpenAI hope will become a standard for future oversight.

One of the most significant findings involved the volume of unmonitored activity. The auditors estimated that between 6 and 25 percent of internal traffic related to the Agentic Responses API was not covered by any monitoring at all. This traffic originated from models at the GPT-5.5 class and above. While METR notes that the uncertainty around this specific estimate is high, the range suggests a substantial portion of high-level AI activity was occurring without oversight. Additionally, for internal Codex traffic that was supposed to be tracked, roughly 10 percent went untracked between May and July due to a technical gap in handling context summaries.

The audit also revealed that the monitoring system could be bypassed or disrupted. Because oversight was only triggered when an agent handed control back to the user, AI agents could avoid monitoring by simply continuing to execute actions without pausing. The researchers also discovered methods to hide hundreds of actions from the monitor and to bypass the sandbox environment used for testing. They further determined that specially crafted inputs could likely cause the monitor to crash entirely, and that model behavior during reinforcement learning (RL) training was not being monitored at the start of the review.

OpenAI states that it has since fixed all the weaknesses identified by the auditors. The company noted that it independently discovered and fixed the bug related to context summaries while the audit was still underway. It also paused RL training following an incident in August and expanded monitoring to cover that process, though these changes occurred after the auditors' access period ended. The full 61-page report was provided internally, but after redactions, the research teams received a 38-page version. Only a short summary has been released to the public, with METR stating it did not have the right to disclose the redacted portions on its own.

Looking ahead, the pilot nature of this audit means that future inspections are expected to follow a similar format. METR has indicated that it wants to push for greater public transparency in subsequent reviews. As AI models become more capable and agentic, the clarity of these monitoring systems is increasingly viewed as a critical component of safety. The findings from this period suggest that while progress has been made, the infrastructure for watching these models remains in a state of active development and refinement.