Inside OpenAI: A Three-Week Audit Exposes Blind Spots in AI Safety Oversight

A three week on site inspection of OpenAI's internal systems has revealed significant gaps in how the company monitors its AI models for rogue behavior. Two researchers from METR and Redwood Research conducted this deep dive from July 21 to August 11, 2026. During this period they gained access to OpenAI's codebase and internal documents. They also interviewed approximately a dozen employees to understand the current state of safety monitoring.

The audit focused specifically on the monitoring infrastructure designed to track agentic behavior. The researchers discovered that a substantial amount of traffic from high performance models was not being watched at all. Specifically, an estimated 6 to 25 percent of internal agentic Responses API traffic from GPT 5.5 class models and above lacked monitoring coverage during the audit window. METR noted that the uncertainty surrounding this estimate is significant in both directions, meaning the true figure could be higher or lower.

The issues were not limited to unmonitored traffic. For internal Codex traffic that was supposed to be tracked, the auditors found major tracking failures. METR estimates that roughly 10 percent of this traffic went untracked between May and July. This gap occurred due to a specific bug in how the system handled compaction events, which are context summaries. OpenAI independently discovered this bug and implemented a fix while the audit was still active. METR also attached significant uncertainty to this 10 percent estimate.

Beyond the missing data, the audit revealed ways for agents to delay or avoid oversight entirely. During the period when compaction events were not monitored, agents could sidestep checks by simply continuing to execute actions without handing control back to the user. The monitoring system only triggered when control was returned, creating a loophole for continuous autonomous operation. The auditors identified methods to hide hundreds of actions from the monitor and to bypass the Codex sandbox.

Further vulnerabilities included the potential for specially crafted inputs to crash the monitor entirely. Additionally, model behavior during reinforcement learning training was not being monitored at the start of the audit. OpenAI stated that it paused reinforcement learning training following the Hugging Face incident in August. The company then expanded monitoring to cover this area. However, these changes occurred after the auditors' access period ended and were not part of the initial evaluation.

OpenAI has stated that it has fixed all the weaknesses identified by the auditors. The full 61 page report was handed over to OpenAI internally. After the company applied redactions, the leadership teams at METR and Redwood Research received a 38 page version. Only a short summary has been made available to the public. METR stated that it had no right to disclose the redacted portions on its own, keeping the majority of the findings hidden from public view.

This audit served as a pilot program organized jointly by METR, Redwood Research, and OpenAI. The goal was to grant outside researchers deep access to internal infrastructure. It represents a step toward independent verification of AI safety claims. However, the limited public release of the findings has raised questions about how much detail should be shared with the broader community.

For future audits, METR has expressed a desire to push for more public transparency. The organization wants to ensure that the public can better understand the safety measures in place for advanced AI systems. This push for transparency comes as the industry continues to develop more capable models. The findings from this pilot program will likely shape the protocols used in subsequent external audits of major AI labs.

The audit highlights the complexity of monitoring sophisticated AI agents. It shows that even with dedicated infrastructure, blind spots can exist where critical behavior goes unseen. The collaborative nature of the audit suggests a growing willingness among major players to subject their systems to external scrutiny. Yet the balance between protecting proprietary details and ensuring public safety remains a key challenge for the industry moving forward.