Outside researchers found gaps in OpenAI’s internal AI-agent monitoring system that could have let some agents carry out hundreds of actions without their activity being checked.
The findings came from a three-week review by the nonprofits METR and Redwood Research, whose researchers received access to internal code, monitoring configurations and technical staff. Their work, conducted from July 21 to August 11, examined the system as it stood on or before July 21.
One flaw could have allowed agent activity to go unmonitored. Another raised the prospect that Codex agents could circumvent permission restrictions. The reviewers could not determine whether either weakness had been exploited in practice.
OpenAI said it had patched vulnerabilities affecting production safeguards. The outside researchers had not independently verified those fixes when their findings became public on October 22.
The review offers an unusually close look at a problem that grows more consequential as AI agents gain access to files, software and external services. It is not enough for an agent to have rules governing what it may do. The systems meant to record and inspect its actions must also work.
The researchers delivered a 61-page report to OpenAI. A shorter version was shared with leadership at the two nonprofits, but the public account contains only selected findings. OpenAI could redact information it regarded as confidential or sensitive, limiting what outsiders can examine.
The investigation does not show that OpenAI agents routinely evade oversight. It does show that monitoring systems can contain weaknesses of their own, and that outside access is one way to find them.
OpenAI headquarters in San Francisco. Photo: Coolcaesar / Wikimedia Commons, CC BY 4.0.
Reporting: METR and Redwood Research; Reuters.
