METR and Redwood publish red-team report on OpenAI internal agent monitoring with novel bypasses
METR and Redwood Research published a three-week red-team report testing OpenAI's internal system for supervising agents. Effective monitoring coverage for eligible actions was 75% to 94%, with bypass paths triggerable via client-controlled parameters.
METR and Redwood Research jointly published a 61-page report on October 22 detailing a three-week red-team test of OpenAI's internal agent monitoring system, covering a window from July 21 to August 11.
Among eligible actions, effective monitoring coverage measured between 75% and 94%, reaching 99.2% on Codex, with the monitor's own false positive rate below 0.2%. The report notes that roughly a 10% gap stems from the session compaction stage, one of the main reasons coverage does not reach 100%.
The red team also found a bypass path triggerable through client-controlled parameters that could cause Codex to skip sandbox restrictions. The report characterises such issues as engineering fixes rather than a need for model retraining. OpenAI did not issue a separate response.