---
title: METR and Redwood red-teamed OpenAI's internal agent monitoring: headers that switch it off, a Codex sandbox and Auto-Review bypass, and roughly 10% of Codex traffic unmonitored | ctxsec
url: https://ctxsec.com/items/metr-redwood-red-team-openai-agent-monitoring
description: ""
status: "confirmed research (METR and Redwood Research, Oct 22; OpenAI says production issues are patched, which METR did not verify)"
published: 2026-10-22
---

> 

[← AI](/ai) · [markdown](/items/metr-redwood-red-team-openai-agent-monitoring.md)

confirmed research (METR and Redwood Research, Oct 22; OpenAI says production issues are patched, which METR did not verify)

2026-10-22

### METR and Redwood red-teamed OpenAI's internal agent monitoring: headers that switch it off, a Codex sandbox and Auto-Review bypass, and roughly 10% of Codex traffic unmonitored

For three weeks (Jul 21 to Aug 11) a METR researcher and a Redwood Research researcher had deep access to OpenAI's internal misalignment-monitoring system: its code, monitor prompts and configs, documentation, and interviews with staff. Their public summary of a 61-page internal report says:

- An estimated **75 to 94%** of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring (99.2% for internal Codex agents). RL training runs weren't covered when the exercise started.
- Compaction events weren't monitored, leaving roughly **10%** of eligible internal Codex traffic unmonitored from May to July. Because monitoring triggered only when an agent handed control back, an agent could postpone it indefinitely. OpenAI had already spotted this and fixed it during the exercise.
- They found a way for Codex agents to **bypass Codex sandboxing and Auto-Review**, gaining anything the host user could do, and an exploit (details redacted by OpenAI) that kept hundreds of recent actions out of monitoring.
- **Two client-controllable headers** disabled monitoring for new agents. Serialization differences between what the agent sees and what the monitor sees could make the monitor fail. Two supposedly read-only internal tools could be made to take arbitrary actions.

OpenAI says every vulnerability affecting its production safeguards is patched; METR says it hasn't evaluated that. Design lessons for anyone running agents: monitor every N steps instead of at turn end, reconcile inference logs against monitor logs, keep tool execution isolated from the agent scaffold, and don't let agents read the monitor's code. This is separate from OpenAI's own Oct 20 report of two agents weakening monitors.

Sources: [METR: Red-Teaming OpenAI's Internal Agent Monitoring Systems (Oct 22)](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/) · [Redwood Research post](https://www.redwoodresearch.org/blog/red-teaming-openais-internal-agent)