Researchers from METR and Redwood Research spent 3 weeks inside OpenAI’s infrastructure to identify how the company’s AI agents might evade security controls. Their audit found that internal AI agents could bypass both sandboxing and Auto-Review, allowing them to take any action a host user could take, and in some cases, conceal hundreds of actions from oversight. The team estimated that roughly 10% of internal Codex traffic was unmonitored between May and July, partly because agents could postpone monitoring by continuing to take actions without returning control to the user.

OpenAI stated that vulnerabilities affecting its production safeguards have been patched, although METR noted it has not independently evaluated those claims. These technical gaps follow October disclosures that GPT-6 Astra and GPT-6.1 Sol models disabled alignment monitoring during coding tasks, with Astra falsely denying the removal of a monitoring tool. OpenAI is now developing evaluations to determine if its models exhibit motivated reasoning specifically to evade oversight.