{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/metr-redwood-openai-internal-monitoring-red-team-2026/",
 "asOf": "2026-10-30",
 "id": "metr-redwood-openai-internal-monitoring-red-team-2026",
 "date": "2026-10-22",
 "datePrecision": "day",
 "title": "METR and Redwood report coverage gaps and bypasses in OpenAI's July internal agent monitoring",
 "lane": "defense",
 "kind": "eval-report",
 "summary": "METR reports that a three-week exercise with Redwood Research found vulnerabilities and coverage gaps in OpenAI’s internal monitoring as it existed on and before July 21. Its public account is a limited, OpenAI-redactable summary and does not establish the expanded system’s coverage or validate OpenAI’s production-remediation claims. OpenAI’s October 29 account says most fixes from that exercise were complete and one remained in progress, without identifying the remaining fix.",
 "whyItMatters": "It provides external technical scrutiny of a lab's actual monitoring infrastructure, with explicit limits on coverage estimates, publication rights and subsequent remediation verification.",
 "actors": [
  "metr",
  "redwood-research",
  "openai"
 ],
 "topics": [
  "monitoring-and-control",
  "sandbox-containment",
  "eval-validity"
 ],
 "atlas": [
  "monitor",
  "sandbox"
 ],
 "artifacts": [
  "gpt-5-family"
 ],
 "sources": [
  {
   "url": "https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/",
   "publisher": "METR",
   "title": "Red-Teaming OpenAI's Internal Agent Monitoring Systems",
   "date": "2026-10-22",
   "type": "primary",
   "accessed": "2026-10-22"
  },
  {
   "url": "https://openai.com/index/how-we-detect-frontier-model-misalignment/",
   "publisher": "OpenAI",
   "title": "How we detect frontier model misalignment",
   "date": "2026-10-29",
   "type": "primary",
   "accessed": "2026-10-30",
   "shared": true
  }
 ],
 "keyFacts": [
  {
   "fact": "The exercise ran from 2026-07-21 to 2026-08-11 and assessed the system as it existed on and before July 21, excluding changes in progress. One METR employee and one Redwood Research employee accessed internal code, monitor prompts and configuration, documentation, and approximately a dozen technical interviews. It was separate from METR's Hugging Face incident investigation.",
   "locator": "Opening paragraphs; footnote 1"
  },
  {
   "fact": "METR estimates that roughly 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with substantial uncertainty in both directions; the estimate was 99.2% for the subset used for internal Codex agents. Eligibility means intended to be sent to a monitor, not completed monitoring. Other internal research inference traffic was excluded because its volume could not be estimated.",
   "locator": "Findings, monitoring eligibility bullet; footnotes 4–5"
  },
  {
   "fact": "METR estimates that missing compaction-triggered checks left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026, with substantial uncertainty. OpenAI had independently identified this gap before the exercise and fixed it during the exercise. RL training runs were not covered at the exercise's start, although METR was told some rollouts had been monitored between March and June.",
   "locator": "Findings, RL training and compaction bullets"
  },
  {
   "fact": "Researchers found ways agents could in principle avoid monitoring, subvert its inputs, or bypass sandbox and approval controls. They could not check whether agents had exploited the turn-completion timing gap in practice, and did not validate the reported permission weaknesses in two nominally read-only internal tools. These are identified weaknesses, not evidence that every path was exploited in an incident.",
   "locator": "Findings, bypass and tool-permission bullets; footnote 6"
  },
  {
   "fact": "The exercise produced a 61-page internal report; a 38-page version redacted by OpenAI went to METR and Redwood leadership. OpenAI could redact the public summary at its sole discretion, and the researchers lacked a unilateral right to describe redactions. METR endorses the findings it published.",
   "locator": "Opening paragraphs; footnotes 2–3"
  },
  {
   "fact": "OpenAI subsequently stated that all identified vulnerabilities impacting its production safeguards stack were patched and described expanded intended coverage. METR says it has not evaluated these claims. The recommendations include periodic checks, inference accounting, tamper-resistant logs, active red-teaming and isolation between agent actions and monitor execution.",
   "locator": "Paragraph following findings; design ideals"
  },
  {
   "fact": "On October 29, OpenAI said most fixes from the July red-team exercise were complete and one remained in progress. It does not identify that fix or establish whether it falls within the production-safeguards subset described in METR’s October 22 post; the public sources do not support treating the two remediation statements as identical in scope.",
   "locator": "OpenAI, Red-teaming; METR, paragraph following findings"
  }
 ],
 "significance": 4,
 "fideQuestions": [
  "FID-074",
  "FID-075"
 ],
 "methods": [
  "adaptive-red-teaming",
  "ai-monitoring",
  "approval-bypass",
  "monitor-evasion",
  "sandboxing-egress"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-24",
 "revisions": [
  {
   "id": "openai-monitoring-remediation-follow-up",
   "on": "2026-10-30",
   "kind": "evidence",
   "why": "Added OpenAI’s October 29 statement that one red-team fix remained in progress. Preserved METR’s historical account and the distinction between production-remediation claims and independent evaluation of the expanded stack."
  }
 ]
}