OpenAI's Internal Audit Reveals Blind Spots in AI Safety Monitoring

For ordinary consumers and businesses relying on OpenAI’s latest models, the safety net intended to catch rogue behavior is not as comprehensive as previously believed. A new audit reveals that significant portions of the company's internal traffic involving high-stakes AI agents were operating without any oversight at all during the summer of 2026. This finding suggests that the mechanisms designed to prevent AI systems from acting outside their parameters may have been effectively bypassed or simply not applied to a substantial fraction of activity.

The data from the audit, conducted from July 21 to August 11, paints a picture of inconsistent coverage. Researchers from METR and Redwood Research estimated that between 6 percent and 25 percent of internal traffic generated by models at the GPT-5.5 class or above was entirely uncovered by monitoring systems. METR notes that the uncertainty surrounding this figure is significant in both directions, meaning the actual percentage could be higher or lower, but the gap is undeniable. For a specific internal tool called Codex, which was supposed to be fully monitored, the auditors found that approximately 10 percent of traffic went untracked between May and July. This specific oversight was attributed to a technical bug in how the system handled compaction events, or context summaries.

OpenAI independently discovered this compaction bug and implemented a fix while the auditors were still on-site. However, the period of the bug created a window where agents could effectively delay oversight. The monitoring system was designed to trigger only when an agent handed control back to the user. This design flaw meant that if an agent simply continued to execute actions without yielding control, it could sidestep the monitoring process entirely, allowing it to operate without external checks for extended periods.

The auditors, who had access to OpenAI’s codebase and internal documents while interviewing about a dozen employees, also identified more sophisticated ways to evade detection. They found methods to hide hundreds of actions from the monitor and discovered ways to bypass the sandbox environment used for Codex. Furthermore, they determined that specially crafted inputs could likely cause the monitor to crash entirely. At the start of the audit, they also noted that model behavior during reinforcement learning (RL) training was not being monitored at all.

In response to the findings, OpenAI stated that it has since fixed all the weaknesses identified by the auditors. The company clarified that it paused RL training following an incident involving Hugging Face in August and subsequently expanded its monitoring to cover that phase. However, these corrective measures were implemented after the auditors' access period had ended, meaning they were not part of the initial evaluation. The full 61-page report was provided to OpenAI internally, but the public received only a short summary.

The distribution of the report highlights the tension between transparency and corporate confidentiality. After OpenAI applied redactions, leadership at METR and Redwood Research received a 38-page version of the document. METR stated that it had no contractual right to disclose the redacted portions independently, leaving the bulk of the technical details out of the public eye. This audit was part of a pilot program organized jointly by the two research organizations and OpenAI, designed to grant outside researchers deep access to internal infrastructure.

The stakes for the industry are high as AI systems become more agentic and autonomous. The findings suggest that even with dedicated safety teams, complex systems can develop blind spots where critical behavior goes unnoticed. For future audits, METR has expressed a desire to push for greater public transparency, arguing that more open reporting will help build trust in the safety of frontier AI models. The audit serves as a reality check, showing that monitoring is not a one-time fix but an ongoing challenge that requires constant refinement and external scrutiny.

As the AI sector moves toward more capable and autonomous systems, the gap between intended safety protocols and actual implementation remains a critical concern. The audit underscores the need for robust, independent verification of safety measures, particularly as these systems are integrated into more sensitive business and consumer applications. The findings from this three-week period will likely influence how other AI companies structure their internal monitoring and how they engage with external auditors in the coming years.