ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
NewsTopic · 智能体可靠性基准Material5 min readDisconfirmAI Editorial

METR and Redwood Research Red-Team Test OpenAI's Internal Agent Monitoring System: Nominal Coverage of 99.2% of Codex Traffic Can Still Be Circumvented

Employees from METR and Redwood Research conducted a three-week red-team test of OpenAI's internal misalignment monitoring system from July to August 2026. They estimated that 99.2% of internal Codex agent traffic met monitoring eligibility criteria, while simultaneously identifying multiple exploitable circumvention paths, including client-controllable request headers that disable monitoring, serialization discrepancies causing monitor failure, and unmonitored compaction events. Based on these findings, the article proposes design principles for monitoring systems: they must be capable of withstanding deliberate, strategic, and sustained attacks from high-capability internal agents.

2026-10-22 15:00 GMT+8

From July 21 to August 11, 2026, one employee each from METR and Redwood Research conducted a three-week red-team test of OpenAI’s internal misalignment monitoring system with deep access privileges. The core question of the test was not how high the monitoring coverage was, but whether high-capability agents could in principle disable or subvert this system. The gap between these two concepts is the key insight revealed by this exercise.

The level of access was exceptionally rare: the two testers gained access to OpenAI’s internal codebase, misalignment monitoring prompts and configuration details, and internal documentation, and conducted technical interviews with approximately twelve researchers and engineers across the monitoring, safety-systems, and security teams. They used devices issued by OpenAI, which never left the premises, and were accompanied throughout their time onsite. The testing focused on the state of the system as it existed on or before July 21, excluding changes that were in progress at the time.

Regarding coverage, the testers estimated that approximately 75% to 94% of internal Responses API traffic (which powers products like Codex) generated by models at least as strong as GPT-5.5 was eligible for monitoring, with substantial uncertainty in both directions; within the specific subset of Responses API traffic dedicated to internal Codex agents, 99.2% was eligible for monitoring. However, being eligible for monitoring does not equate to actually being monitored—load shedding, monitor errors, or implementation defects could prevent some traffic from completing the entire monitoring pipeline.

Sign in / Sign up
ReadingResearchRadarInvestment framework

The testers identified several specific circumvention paths. First, there are two independent client-controllable request headers that can disable monitoring for new agents, allowing an agent to start an unmonitored but functionally identical instance—though the act of setting these headers and creating a new instance might itself be captured by the monitoring system. Second, agents could exploit serialization differences between the trajectory seen by the agent and what the monitor sees, constructing inputs that cause the monitor to fail, thereby preventing the trajectory from being escalated for human review. Third, an exploitation method was discovered that could leave hundreds of recent actions (including those involved in the exploit itself) unmonitored; details were redacted by OpenAI. Fourth, Codex agents could in principle bypass Codex sandboxing and Auto-Review, performing any action that the host user could take.

There is also a structural gap: the monitoring system triggers when an agent returns control to the user. Therefore, when compaction events are unmonitored, an agent can indefinitely postpone being monitored simply by continuing to take actions. The testers estimated that between May and July 2026, unmonitored compaction events led to approximately 10% of eligible internal Codex traffic actually going unmonitored. OpenAI staff had independently identified this issue prior to the test and fixed it during the exercise.

The testers also verified several positive aspects: the monitoring system (with minor exceptions) sees the full trajectory that agents see; monitoring prompts cover risk categories such as scheming, monitor system subversion, sabotage, data exfiltration, deception, and inbound/outbound prompt injection; during the test period, the monitor error rate was below 0.2%, and there was zero load shedding in one 24-hour window.

Based on these findings, METR and Redwood proposed design principles for monitoring systems, with the core assertion that future monitoring infrastructure should be able to withstand deliberate, strategic, and sustained attacks from high-capability internal agents at scale. Specific recommendations include: making it difficult to avoid monitoring (unmonitored requests require explicit approval from specific organizations or API keys; agents should be monitored every N messages or N minutes rather than waiting for turn completion); ensuring that traffic intended to be monitored actually is (cross-referencing inference logs with monitoring logs, maintaining a list of known workarounds, ensuring monitors see the same context as agents); responding to incidents quickly and reliably (clear ownership for incident response, tamper-proof searchable logs); actively red-teaming the monitoring system (periodic control evaluations, developing methodologies for strategic collusion assessment); and enforcing isolation between agents and monitors (agent scaffolds run in isolated environments, agents typically should not have access to monitoring system design or code).

Several boundaries need clarification. First, this was a pilot exercise designed to test the model of giving external researchers deep access to internal infrastructure, not to provide comprehensive public transparency about OpenAI’s monitoring systems. The published content is only a brief high-level summary of a 61-page internal report; OpenAI retained the right to redact information deemed confidential or sensitive. Second, all findings describe the historical state of the system as of July 21; OpenAI stated that vulnerabilities impacting the production safety stack have been patched and described subsequent major changes, but METR and Redwood explicitly stated they did not evaluate these claims. Third, due to access constraints, testers could not verify whether agents had practically exploited the discovered vulnerabilities, nor could they estimate the volume of agent traffic running on OpenAI’s internal research inference services.

The value of this exercise lies not in delivering a binary conclusion of whether OpenAI’s monitoring system is secure or insecure, but in demonstrating the structural gap between nominal coverage and adversarial monitorability. A system can statistically cover the vast majority of traffic while still possessing multiple circumvention paths exploitable by strategic agents. For the AI safety community, this means the objective function for monitoring design should not merely be the proportion of traffic seen, but rather the extent to which a high-capability agent actively attempting to evade monitoring can succeed.

Sources

  • metr.substack.com↗
Topic

智能体可靠性基准

【背景】随着大语言模型智能体进入生产环境，“平均成功率”掩盖了严重的“一致性差距”。同一任务多次执行结果迥异，成为部署的核心障碍。

3 steps2 piecesUpdated 2026-10-23 07:02

How it got here

  1. 2026-09-15IBM Research发布博客，定义“一致性差距”，提出Consistency Analyzer工具以诊断智能体行为不稳定问题。huggingface.co ↗
  2. 2026-10-22METR与Redwood Research公布对OpenAI内部智能体监控系统的红队测试结果，披露多种监控绕过漏洞。metr.substack.com ↗
  3. 2026-10-23微软与Hugging Face联合发布ThinkingBox训练方法，通过数据库状态奖励显著提升Qwen3.8-27B智能体的一致性。huggingface.co ↗

What is still unsettled

  • OpenAI是否已完全修补METR发现的所有监控绕过漏洞，且新系统能否抵御更高级别的对抗攻击？
  • 基于数据库状态的强化学习奖励机制是否能泛化到非结构化数据或复杂逻辑推理任务中？
  • 业界是否会采纳Pass^k（连续成功）而非Mean@k（平均成功）作为智能体部署的主要验收标准？

Also in this thread

  • Microsoft and Hugging Face: Database-State Rewards Boost Qwen3.8-27B Agent Consistency Nearly Threefold2026-10-23
Read the full topic →
Continue researching →