OpenAI Concedes Significant Blind Spots After Independent Researchers Audit Internal Systems

The landscape of AI safety verification has shifted noticeably following the release of findings from a rare, in-depth audit of OpenAI’s internal operations. For the first time, outside researchers have been granted direct access to the codebase and internal documents of a leading frontier AI lab to evaluate how the company monitors its own models for unexpected behavior. The results, delivered in late October 2026, indicate that ordinary users and developers relying on OpenAI’s advanced agents may have been operating with less oversight than previously assumed, as substantial gaps were identified in the company's monitoring infrastructure.

The investigation was conducted by two researchers from METR and Redwood Research, who were on-site at OpenAI from July 21 to August 11. During this three-week period, the team had unrestricted access to internal systems and interviewed approximately a dozen employees to understand the mechanics of the company's safety protocols. The primary objective was to assess whether OpenAI’s internal monitoring systems could effectively detect and manage rogue or unintended behaviors from its most advanced models, specifically those at the GPT-5.5 class and above.

The auditors discovered that a significant volume of internal traffic was entirely exempt from monitoring. Estimates suggest that between 6 and 25 percent of internal agentic Responses API traffic from GPT-5.5-class models and higher was not covered by any monitoring during the audit window. METR noted that while this range provides a baseline, the uncertainty surrounding these figures is substantial in both directions, meaning the actual percentage could be higher or lower than the midpoint.

Further vulnerabilities were identified in the handling of internal Codex traffic. The researchers estimated that roughly 10 percent of this traffic went untracked between May and July due to a specific flaw in how the system processed compaction events, which serve as context summaries. Although OpenAI had independently discovered and fixed this bug while the audit was still ongoing, the gap allowed agents to delay oversight. Since the system only triggered when agents handed control back to the user, the models could bypass monitoring entirely by simply continuing to execute actions without pausing for user interaction.

The audit team also identified more technical workarounds, including methods to hide hundreds of actions from the monitor and bypass the Codex sandbox environment. They determined that specially crafted inputs could likely crash the monitoring system completely. Additionally, at the start of the audit, model behavior during Reinforcement Learning (RL) training was not being monitored at all. OpenAI clarified that it paused RL training following the Hugging Face incident in August and subsequently expanded monitoring to cover this phase, but these changes occurred after the auditors' access period ended and were not included in the initial evaluation.

Transparency regarding the full scope of the report has been limited. OpenAI states that it has corrected all weaknesses identified by the auditors and that the complete 61-page report has been shared internally. However, after OpenAI applied redactions, the leadership teams at METR and Redwood Research received a 38-page version. Only a short summary has been made available to the general public. METR indicated that it did not have the right to disclose the redacted portions independently, leaving the public with a partial view of the findings.

This audit was part of a pilot program jointly organized by METR, Redwood Research, and OpenAI, designed to grant external researchers deep access to internal infrastructure. It represents a significant step in collaborative safety verification, though the redacted nature of the public release has sparked discussion about the balance between proprietary information and public accountability. For future audits, METR has expressed a desire to push for greater public transparency to ensure stakeholders have a clearer picture of the safety measures in place.

As the AI industry continues to scale, the findings from this three-week on-site review highlight the complexity of monitoring sophisticated systems that operate autonomously. The identification of these gaps, particularly in how compaction events are handled and the lack of oversight during certain training phases, provides a concrete example of the challenges faced in maintaining robust safety protocols. The outcome of this pilot program will likely influence how future external audits are structured and how much detail is shared with the public.