6% to 25% of Critical AI Traffic Escaped Safety Monitoring in Three-Week OpenAI Audit

OpenAI is currently addressing a series of significant gaps in its internal safety monitoring infrastructure, identified by a two-week on-site audit conducted by independent researchers. The evaluation was performed by experts from METR and Redwood Research, who spent three weeks embedded within the company to examine how the organization tracks the behavior of its advanced AI systems. Their primary focus was on the mechanisms designed to detect and monitor "rogue" or unexpected actions taken by the company's most capable models.

The audit took place from July 21 to August 11, 2026. During this period, the research team was granted access to OpenAI’s internal codebase and documentation. They also conducted interviews with approximately a dozen employees to understand the operational context of the monitoring tools. This level of access was part of a pilot program designed to allow outside researchers to scrutinize internal infrastructure in a way that is not typically possible for the public or external observers.

The most striking finding from the investigation concerns the volume of traffic that was not subject to any safety oversight at all. The researchers estimated that between 6 and 25 percent of internal traffic from the Responses API, specifically from models at the GPT-5.5 class or higher, bypassed monitoring entirely during the audit window. METR noted that this estimate carries significant uncertainty in both directions, meaning the actual figure could be higher or lower, but the range highlights a substantial portion of the company's high-level activity that was operating without a safety net.

Beyond the completely unmonitored traffic, the auditors identified specific technical flaws in the systems that were supposed to be active. For internal Codex traffic, METR estimates that roughly 10 percent of actions went untracked between May and July 2026. This gap was caused by a bug in how the system handled "compaction events," which are essentially context summaries used to manage memory. OpenAI had independently discovered and fixed this bug before the audit concluded, though the auditors still counted it as a weakness because it existed during their period of observation.

The audit also revealed structural weaknesses that allowed agents to delay or avoid oversight. Because the monitoring system was triggered only when an agent handed control back to a user, agents could theoretically sidestep oversight by simply continuing to execute actions without pausing. Furthermore, the researchers found methods to hide hundreds of actions from the monitor and to bypass the Codex sandbox. They also determined that specially crafted inputs could likely crash the monitoring system entirely, leaving the AI model running without any safety checks.

Another area of concern was the lack of monitoring for model behavior during reinforcement learning (RL) training at the start of the audit. OpenAI stated that it paused RL training following the Hugging Face incident in August 2026 and subsequently expanded its monitoring to cover this process. However, these corrective measures were implemented after the auditors' access period ended and were therefore not included in the final evaluation of the system's state during the audit.

Following the audit, OpenAI confirmed that it has fixed all the weaknesses identified by the researchers. The full report, which spans 61 pages, was handed over to the company internally. After OpenAI applied redactions, the leadership of METR and Redwood Research received a 38-page version. Only a short summary has been made available to the general public, with METR stating it had no right to disclose the redacted portions independently. For future audits, METR has indicated it intends to push for greater transparency in the public release of findings.

The findings underscore the complexity of monitoring autonomous AI systems at scale. While OpenAI has taken steps to rectify the identified issues, the audit highlights the challenges of ensuring comprehensive oversight across diverse internal workflows and model interactions. The pilot nature of this program suggests that similar deep-dive evaluations may become more common as AI systems grow in capability and operational scope.