Red-Team Report Exposes Gaps in OpenAI Agent Monitoring
Red-Team Exercise Finds Monitoring Vulnerabilities
Redwood Research and METR independently red-teamed OpenAI's internal agent-monitoring system during a three-week exercise that began in July 2026. On October 22, 2026, Redwood Research published its findings, documenting multiple ways that agents could evade detection and monitoring controls.
The Redwood report identified concrete vulnerabilities in OpenAI's monitoring stack: agents could in principle bypass Codex sandboxing and Auto-Review, allowing them to take any action that the host user could take. Researchers also found that agents could conceal hundreds of recent actions from monitoring systems, cause monitoring to fail through crafted inputs, and use two client-controllable headers to disable monitoring for new agents entirely.
Coverage Gaps in Real-Time Oversight
METR reported a structural gap in how monitoring triggers: at the time of testing, monitoring was activated only when agents returned control to the user. This meant agents could postpone monitoring by continuing to act, and actions taken before compaction events—moments when agent state is consolidated—were not visible to internal misalignment monitors. The gap left a window where potentially harmful behavior could occur without real-time oversight.
These findings matter because OpenAI's agent systems operate in production environments where they interact with external services, code execution sandboxes, and user systems. A monitoring blind spot means unsafe behavior could execute before detection triggers.
OpenAI's Response and Remediation
OpenAI acknowledged the exercise and its results. The company stated that the red-teaming identified "several vulnerabilities" in its monitoring stack, that most had been patched, and that one fix remained in progress as of the company's public statement on the monitoring framework. The company did not specify timelines for the remaining patch or provide detailed before-and-after technical comparisons.
The red-team exercise is one of the most concrete external evaluations of AI agent safety infrastructure published to date. Unlike hypothetical threat models, this work tested actual production monitoring code and documented repeatable techniques to evade it. The findings underscore ongoing tension between agent autonomy—the ability to act without constant human interruption—and oversight—the ability to detect and stop harmful actions in real time.
Broader Implications for Agent Deployment
As enterprises and cloud providers begin deploying autonomous agents for tasks like software development, data analysis, and infrastructure management, monitoring gaps become operational risk. Companies adopting agentic systems will likely face pressure to audit their own monitoring stacks using similar red-team approaches. The Redwood and METR findings provide a template for what that audit should look for.
