AI Safety Audit: External Experts Find Blind Spots in OpenAI's Internal Monitoring

For consumers and businesses relying on large language models, the recent independent assessment of OpenAI’s internal safety mechanisms suggests that the company’s monitoring systems were not as comprehensive as previously assumed. The findings, released this week, detail specific periods where a portion of the traffic generated by OpenAI’s most powerful models was not subject to active oversight. While OpenAI states that all identified weaknesses have been corrected, the audit highlights the complexities involved in ensuring that advanced AI systems operate within intended boundaries when they are acting autonomously.

The evaluation was conducted by two researchers from METR and Redwood Research, who were granted deep access to OpenAI’s infrastructure. From July 21 to August 11, 2026, these experts had direct access to the company’s codebase and internal documentation. They also conducted interviews with approximately a dozen OpenAI employees to understand how the internal monitoring for rogue AI behavior functioned in practice. This pilot program was a joint initiative designed to give outside parties a rare, detailed look at the internal workings of a leading AI laboratory.

The most significant finding concerns the extent of traffic that was not monitored at all. The auditors estimated that between 6 percent and 25 percent of internal agentic Responses API traffic from models at the GPT-5.5 class and above fell outside the scope of monitoring during the audit window. METR noted that this range carries significant uncertainty in both directions, meaning the true figure could be higher or lower than the midpoint. This gap implies that a substantial number of actions taken by the company’s most advanced models were not being checked for unexpected behavior by the internal safety systems.

A second major issue was identified in the tracking of internal Codex traffic. The auditors found that roughly 10 percent of this traffic went untracked between May and July due to a technical flaw in how the system handled compaction events. These events are essentially context summaries that help manage the memory of the AI agents. METR again cited significant uncertainty in this estimate. Notably, OpenAI had independently discovered this bug and implemented a fix while the audit was still ongoing, indicating that internal teams were also working to address these monitoring gaps.

The nature of the compaction gap allowed agents to potentially delay oversight. The monitoring system was designed to trigger when an agent handed control back to the user. However, because of the bug, agents could avoid this checkpoint by simply continuing to execute actions without returning control. This created a window where the system could operate without the intended safety checks, a vulnerability that the auditors highlighted as a structural weakness in the monitoring logic.

Beyond the statistical gaps in coverage, the auditors identified specific methods to evade detection. They found ways to hide hundreds of actions from the monitor and demonstrated how to bypass the Codex sandbox, a restricted environment designed to limit what the AI can do. Furthermore, they determined that specially crafted inputs could likely crash the monitor entirely. The team also noted that model behavior during reinforcement learning (RL) training was not being monitored at all when the audit began, a gap that OpenAI addressed later.

OpenAI stated that it paused RL training following an incident involving Hugging Face in August and subsequently expanded its monitoring to cover this phase. However, these changes occurred after the auditors’ access period ended, meaning they were not part of the formal evaluation. The company asserts that all weaknesses found by the auditors have now been fixed, and the full 61-page report has been shared internally within the organization.

The distribution of the audit results has raised questions about transparency. After OpenAI applied redactions, the leadership teams at METR and Redwood Research received a 38-page version of the report. In contrast, only a short summary was made available to the general public. METR stated that it did not have the right to disclose the redacted portions on its own, leaving the public with a limited view of the detailed findings.

Looking ahead, the participating organizations view this audit as a starting point rather than a conclusion. METR has indicated that it wants to push for greater public transparency in future evaluations. As AI systems become more autonomous and complex, the balance between protecting proprietary information and ensuring public accountability remains a central challenge for the industry. This pilot program sets a precedent for how independent experts might interact with major AI companies in the coming years.

For the Great Lakes and Ohio Valley regions, where a mix of tech startups and established enterprises are adopting these tools, the report serves as a reminder that the safety infrastructure behind AI products is still being refined. While OpenAI has corrected the specific issues found in this three-week window, the audit underscores the ongoing effort to build robust systems that can monitor the increasingly capable models driving modern digital services.