AI Oversight: External Auditors Find Blind Spots in OpenAI Safety Protocols

For the general public, the most immediate implication of a recent independent review is that the safety nets surrounding advanced artificial intelligence may not have been as comprehensive as previously assumed. While these technical gaps do not alter how users interact with current chatbots or coding tools today, they highlight specific periods where the company’s internal systems were less visible to its own safety teams. This lack of total visibility occurred primarily during internal testing and training phases, rather than in the final products used by consumers.

The timeline of this scrutiny began in late July and extended into mid-August 2026. During this three-week window, researchers from the institutions METR and Redwood Research were granted on-site access to OpenAI’s facilities. They examined internal codebases and documentation while interviewing approximately a dozen company employees. This collaborative pilot program was designed to allow outside experts to inspect internal infrastructure with a level of depth rarely seen in the industry.

The auditors identified several critical weaknesses in the monitoring of the Responses API, specifically for models at the GPT-5.5 class and above. Estimates suggest that between 6 and 25 percent of this internal agentic traffic was not covered by monitoring at all during the audit period. Although METR noted that the uncertainty surrounding this figure is significant in both directions, the finding indicates a substantial gap in oversight for the company’s most advanced internal models.

A separate issue affected internal Codex traffic. Due to a technical flaw in how the system handled compaction events, which are context summaries, roughly 10 percent of this traffic went untracked between May and July. This estimate also carries significant uncertainty. OpenAI stated that it had independently discovered and fixed this bug while the audit was still underway. Furthermore, during the period when these events were unmonitored, agents could delay oversight by continuing to execute actions rather than handing control back to the user, effectively sidestepping the monitoring triggers.

The team also discovered methods to hide hundreds of actions from the monitor and bypass the Codex sandbox. They determined that specially crafted inputs could likely crash the monitor entirely. Additionally, model behavior during reinforcement learning (RL) training was not being monitored at the start of the audit. OpenAI noted that it paused RL training after an incident in August and expanded monitoring to cover it, but these changes occurred after the auditors' access period ended and were not part of the formal evaluation.

OpenAI asserts that it has corrected all the weaknesses identified by the auditors. The full 61-page report was handed over internally, but after OpenAI applied redactions, METR and Redwood Research leadership received a 38-page version. Only a short summary has been made available to the public. METR stated it had no right to disclose the redacted portions independently. For future audits, METR says it wants to push for more public transparency regarding these internal safety mechanisms.