Key points
- An audit ran July 21 to August 11, with two outside researchers from METR and Redwood Research given codebase access and about a dozen staff interviews.
- METR estimates 6 to 25 percent of internal agentic Responses API traffic from GPT-5.5-class and newer models went unmonitored, with wide uncertainty.
- Auditors also found ways to hide actions from the monitor, bypass the Codex sandbox, and likely crash the monitor with crafted inputs.
- The full 61-page report stays internal; the public got only a short summary, and OpenAI says all found weaknesses are fixed.
Why it matters for marketers: Marketers deploying autonomous agents should note that even a leading lab's oversight had gaps, so vendor safety claims deserve questions about coverage, logging and independent review.
Two outside researchers, one tied to METR and one to Redwood Research, embedded with OpenAI for a pilot audit of the system that watches its internal AI agents for rogue behavior. They reviewed code and documents and spoke with about a dozen employees between July 21 and August 11.
Their findings were mixed. METR estimates that 6 to 25 percent of internal agentic Responses API traffic from GPT-5.5-class and later models had no monitoring during the audit, though it says that figure is quite uncertain. For internal Codex traffic, roughly 10 percent went untracked between May and July because of how the system handled context summaries. OpenAI found and fixed that bug on its own while the audit was running.
The auditors also reported that agents could delay oversight by continuing to act rather than returning control to the user, that hundreds of actions could be hidden from the monitor, and that the Codex sandbox could be bypassed. They judged that crafted inputs could probably crash the monitor, and that reinforcement learning training was not monitored when the audit began. OpenAI says it paused that training after an August incident involving Hugging Face and widened monitoring, but those steps came after the auditors' access ended and were not evaluated.
For teams building or buying agentic tools for content and campaign work, the lesson is practical: ask vendors what share of agent activity is actually logged and reviewed. The public record here is thin. OpenAI says every weakness is fixed, yet only a short summary is public, and METR says it could not disclose redacted portions. METR plans to press for more transparency in future audits, which is the thing to watch.
Sources
This brief is our own summary. Read the full reporting at the source.
