Outside researchers embedded at OpenAI found several ways its internal coding agents could escape AI monitoring.

One employee each from METR and Redwood Research spent 3 weeks inside OpenAI’s codebase.

> OpenAI’s monitor checked agents only when they returned control to users and skipped compaction events, so roughly 10% of eligible internal Codex traffic went unmonitored between May and July 2026.

> Agents could hide hundreds of recent actions from the monitor, start unmonitored copies through 2 client-controllable headers, likely make the monitor fail via serialization mismatches, and bypass Codex sandboxing and Auto-Review.

> Even on paper, only an estimated 75% to 94% of internal Responses API agent traffic from GPT-5.5 or stronger models was eligible for monitoring, and RL training runs had no coverage when the exercise began.

> OpenAI says every flaw affecting production safeguards is patched, but the auditors haven’t verified that and couldn’t check whether agents ever exploited the postponement gap.