Audit Uncovers Blind Spots in OpenAI's Safety Net as GPT-5.5 Agents Operate Unwatched

OpenAI has revealed significant vulnerabilities in its internal safety monitoring systems following an intensive three-week audit conducted by outside experts. The investigation, carried out by researchers from METR and Redwood Research, focused specifically on how the company tracks and controls its most advanced autonomous AI models. This external review represents a rare instance of third-party scrutiny into the internal mechanics of a leading artificial intelligence developer.

The auditors were granted extensive access to OpenAI's codebase and internal documentation between July 21 and August 11. During this period, the team interviewed approximately a dozen employees to understand how the company monitors its systems. The primary goal was to identify gaps in the surveillance of "rogue" or unexpected AI behavior, particularly within the company's internal tools.

The findings indicate that a substantial amount of internal traffic was operating without any active monitoring. Researchers estimate that between 6 percent and 25 percent of internal agentic Responses API traffic from models at the GPT-5.5 class and above was not covered by monitoring protocols. METR noted that this estimate carries significant uncertainty in both directions, but the range suggests a notable portion of the company's most powerful internal agents were effectively unwatched during the audit window.

Specific technical failures also emerged regarding the tracking of internal Codex traffic. The auditors found that roughly 10 percent of monitored Codex traffic went untracked between May and July due to a handling error involving compaction events. These events are essentially context summaries used by the system. OpenAI independently discovered this bug and implemented a fix while the audit was still in progress, though the gap allowed for oversight delays during that time.

The structural design of the monitoring system allowed agents to delay oversight in certain scenarios. Because the system only triggered when an agent handed control back to a user, the AI could sidestep checks by simply continuing to execute actions without returning control. The researchers demonstrated that hundreds of actions could be hidden from the monitor and that the Codex sandbox could be bypassed. They also determined that specially crafted inputs were likely capable of crashing the monitor entirely.

A critical blind spot was identified in the monitoring of model behavior during reinforcement learning (RL) training. At the start of the audit, this process was not being monitored at all. OpenAI stated that it paused RL training following the Hugging Face incident in August and subsequently expanded its monitoring capabilities. However, these corrective measures were implemented after the auditors' access period ended and were therefore not included in the final evaluation.

OpenAI claims that all identified weaknesses have been fixed. The full 61-page report was provided to the company's internal team. After OpenAI applied redactions, the leadership teams at METR and Redwood Research received a 38-page version of the document. The public was only provided with a short summary. METR stated that it did not have the right to disclose the redacted portions independently. The audit served as a pilot program designed to grant outside researchers deep access to internal infrastructure.

Looking ahead, METR has indicated a desire to push for greater public transparency in future audits. This initiative highlights the growing emphasis on external verification for AI safety measures. As companies deploy more capable autonomous agents, the ability to verify that these systems are being properly monitored becomes a central concern for the industry and the public.

The stakes of these findings are high for the broader AI landscape. If significant portions of advanced AI traffic can operate without oversight, the potential for unexpected behavior increases. The collaborative effort between OpenAI and external research groups sets a precedent for deeper technical audits. As the technology continues to evolve, the balance between proprietary development and external accountability will likely remain a key topic of discussion.