Audit Exposes Blind Spots in OpenAI’s Internal Safety Architecture

The integrity of AI safety protocols is under scrutiny after an independent audit uncovered substantial gaps in how OpenAI monitors its internal systems. For New England businesses increasingly integrating these tools, the findings suggest that the safety nets currently in place may not be as comprehensive as previously assumed.

The timeline of this investigation began in July 2026, when researchers from METR and Redwood Research gained on-site access to OpenAI’s infrastructure. Over a three-week period, from July 21 to August 11, the auditors examined the company’s codebase, internal documentation, and monitoring systems while interviewing approximately a dozen employees. This pilot program, jointly organized by the three entities, was designed to provide outside researchers with rare, deep access to internal infrastructure to evaluate how the company detects rogue AI behavior.

The audit revealed that a significant portion of internal traffic was not being monitored at all. METR estimates that between 6 and 25 percent of internal agentic Responses API traffic from models of the GPT-5.5 class and higher fell outside the scope of monitoring during the audit window. The researchers noted that the uncertainty surrounding this specific estimate is significant in both directions. Additionally, for internal Codex traffic that was intended to be monitored, roughly 10 percent went untracked between May and July due to a specific bug involving compaction events, which are context summaries. OpenAI independently identified and fixed this bug while the audit was still underway, though the estimate for that period also carries notable uncertainty.

Beyond simple coverage gaps, the auditors identified structural weaknesses in the oversight mechanisms. During the period when compaction events were not monitored, agents could delay oversight because the system only triggered when control was handed back to the user. This allowed agents to sidestep monitoring by simply continuing to execute actions without pausing. The team also discovered methods to hide hundreds of actions from the monitor and to bypass the Codex sandbox. Furthermore, they determined that specially crafted inputs could likely crash the monitor entirely, and that model behavior during reinforcement learning (RL) training was not being monitored at all when the audit commenced.

OpenAI has stated that it paused RL training following the Hugging Face incident in August and subsequently expanded monitoring to cover this area. However, these changes were implemented after the auditors’ access period ended and were therefore not part of the official evaluation. The company claims to have fixed all the weaknesses identified by the auditors and has distributed the full 61-page report internally.

Currently, most of the detailed findings remain hidden from the public. After OpenAI applied redactions, the leadership teams at METR and Redwood Research received a 38-page version of the report, while only a short summary was released to the general public. METR stated that it did not have the right to disclose the redacted portions independently. Looking ahead, METR has indicated that it intends to push for greater public transparency in future audits, a move that could reshape how AI safety is reported to stakeholders and the broader market.

The implications of these findings extend beyond technical curiosity. They highlight a critical phase in the deployment of agentic AI, where the complexity of internal operations can outpace the visibility provided by current monitoring tools. As the industry moves forward, the balance between proprietary secrecy and public accountability will likely remain a central tension.