Audit Finds 25% of OpenAI's High-Tier Traffic Unmonitored

Up to 25 percent of internal traffic from OpenAI's most advanced models operated without any safety monitoring, according to a report released by two independent research groups. This gap means that a substantial portion of the company's top-tier AI systems ran unchecked for months, leaving users and developers exposed to potential errors or rogue behavior that internal guards were supposed to catch.

The findings come from a pilot audit conducted by METR and Redwood Research. The teams operated on-site at OpenAI from July 21 to August 11. During those three weeks, auditors reviewed the company's codebase, examined internal documents, and interviewed approximately a dozen employees. The exercise was designed to grant outside researchers deep access to the company's internal infrastructure.

The primary issue identified was a lack of coverage in the Responses API. METR estimated that between 6 and 25 percent of agentic traffic from models in the GPT-5.5 class and above was not monitored at all. METR noted that the uncertainty surrounding this range is considerable. A separate problem affected internal Codex traffic. Roughly 10 percent of that traffic went untracked between May and July because the system failed to process context summaries correctly. OpenAI independently discovered and fixed this bug while the audit was still ongoing.

The auditors also found that agents could delay oversight. The monitoring system only triggered when an agent returned control to the user. Consequently, an agent that continued executing actions without handing back control could bypass the monitor entirely. The researchers demonstrated methods to hide hundreds of actions from detection and bypass the Codex sandbox. They also concluded that specially crafted inputs could crash the monitor.

OpenAI states that it has fixed all identified weaknesses. The company paused reinforcement learning training following an incident in August and expanded monitoring to cover that process. These changes occurred after the auditors' access period ended, so they were not included in the evaluation. The full report consists of 61 pages. METR and Redwood Research leadership received a redacted 38-page version, while the public received a short summary. METR stated it did not have the right to disclose the redacted portions independently.

For future audits, METR intends to push for greater public transparency regarding internal model safety checks.