6 to 25 Percent of OpenAI's Top Model Traffic Evaded Safety Checks

OpenAI relies on internal systems to track its most capable models for rogue behavior, but a new external assessment suggests those tools have blind spots. Researchers from METR and Redwood Research reported that between 6 and 25 percent of internal agentic Responses API traffic from models in the GPT-5.5 class and above went completely unmonitored during their audit period.

The inspection was a joint pilot program that gave outside researchers deep access to OpenAI's infrastructure. From July 21 to August 11, the auditors examined the company's codebase and internal documents. They also interviewed approximately twelve employees. METR noted that the uncertainty surrounding the 6 to 25 percent range is high in both directions, meaning the true figure could be lower or higher.

A second gap affected internal Codex traffic. METR estimates that roughly 10 percent of this traffic went untracked between May and July due to a bug in how the system handled compaction events. These events are context summaries that the monitor failed to process correctly. OpenAI identified and fixed this specific bug while the audit was still in progress.

The auditors also found that agents could delay oversight by simply continuing to execute actions without handing control back to the user. The monitoring system was designed to trigger only when an agent yielded control, creating a window where activity could proceed unchecked. The researchers demonstrated methods to hide hundreds of actions from the monitor and bypass the Codex sandbox. They also concluded that specially crafted inputs could likely crash the monitor entirely.

Model behavior during reinforcement learning training was not monitored at all when the audit began. OpenAI stated that it paused RL training following the Hugging Face incident in August and subsequently expanded monitoring to cover this area. Because these changes occurred after the auditors' access period ended, they were not included in the evaluation.

OpenAI says it has fixed all the weaknesses identified by the auditors. The full report is 61 pages long and was distributed internally. After OpenAI applied redactions, the leadership of METR and Redwood Research received a 38-page version. Only a short summary was released to the public. METR stated it had no right to disclose the redacted portions on its own, though the group said it wants to push for greater public transparency in future audits.