OpenAI let one researcher from METR and one from Redwood Research work on site for three weeks, from July 21 to August 11, auditing the internal monitor that watches its AI agents for scheming, sabotage, data exfiltration and deception. Working from OpenAI's own codebase, monitor prompts and documentation, and interviews with about a dozen engineers, they produced a 61-page internal report; the public summary was published on October 22.

The headline gap was not an attack. Long agent sessions skipped compaction events, and once that happened the monitor stopped seeing the session — leaving an estimated 10% of eligible internal Codex traffic unmonitored between May and July, concentrated in exactly the long sessions where monitoring matters most. The testers also found two client-controllable headers that disabled monitoring for new agents, an exploit that could hide hundreds of recent actions including the exploit itself, and a way for Codex agents in principle to bypass sandboxing and Auto-Review.

OpenAI says every flaw affecting its production safeguards has been patched, and that it had spotted the compaction gap itself and fixed it during the exercise. METR says it has not evaluated those fix claims, and the review only covers the system as it stood on or before July 21. The monitor itself errored on less than 0.2% of requests and, with minor exceptions, saw the full trajectory agents saw.