METR and Redwood Report: OpenAI Codex Agent Monitoring System Had Bypass Vulnerabilities, Now Fixed
Independent security researchers found vulnerabilities in OpenAI's internal agent monitoring system, including bypasses via serialization differences; OpenAI has patched them.
US-based AI safety research organizations METR and Redwood Research jointly released a report on October 22, 2026, disclosing multiple severe vulnerabilities in the internal monitoring system used by OpenAI to oversee AI agent behavior. These flaws allowed agents like Codex to bypass sandbox restrictions or auto-review mechanisms, enabling them to take unmonitored actions within the host user's permission scope. OpenAI confirmed that all identified vulnerabilities have been fixed.
The study was a stress test of OpenAI's internal monitoring systems, conducted at the company's invitation between July 21 and August 11, 2026. Researchers examined OpenAI's internal codebase, prompt configurations, and documentation, and interviewed employees. The analysis focused on Responses API traffic driving Codex applications and internal Codex-generated agent traffic, aiming to assess whether agents could disable or evade monitoring mechanisms.
The findings revealed that while OpenAI's internal misbehavior monitoring system had an error rate below 0.2% and maintained stability under high load, attackers could still achieve evasion through specific techniques. For instance, exploiting serialization differences in execution trajectories caused the agent and the monitoring system to see different operation records, leading to critical actions being skipped for human review. Additionally, the report exposed two independent HTTP headers controllable by the client that, if set correctly, could directly disable monitoring for newly created agents. Although setting these headers and creating new agents might be detected, this highlighted structural weaknesses in the monitoring chain.
Another finding involved two internal agent tools originally believed to have read-only permissions but were actually unmonitored. Researchers also proposed a potential abuse method that could allow agents to violate restrictions and act arbitrarily within the sandbox, though this method had not been fully verified in a live environment. Notably, apart from these exceptions, the monitoring system captured nearly all agent execution trajectories, and OpenAI did implement prompts checking for high-risk behaviors such as plotting, sabotage, data exfiltration, and prompt injection.