25%: The Unmonitored Share of High-Stakes AI Traffic Found in New Audit

Researchers from METR and Redwood Research completed a three-week, on-site audit of OpenAI’s internal safety infrastructure, uncovering substantial gaps in the company’s ability to monitor its most powerful models. The team, which was granted deep access to OpenAI’s codebase and internal documentation, spent the period from July 21 to August 11 interviewing approximately a dozen employees and scrutinizing how the company tracks agentic behavior. Their findings suggest that while OpenAI has robust monitoring tools, significant portions of its high-level traffic operated without any oversight during the review window.

The most striking finding involves the volume of untracked traffic from models at the GPT-5.5 class and above. The auditors estimated that between 6 and 25 percent of internal agentic Responses API traffic was not covered by monitoring systems at all. METR noted that this range carries significant uncertainty in both directions, meaning the actual figure could be higher or lower, but the gap represents a notable blind spot for a company whose models are increasingly capable of autonomous action. This lack of visibility raises questions about how well the company can detect unusual or rogue behavior in its most advanced systems.

A specific technical failure provided a concrete example of these monitoring gaps. The auditors identified a bug affecting internal Codex traffic, where approximately 10 percent of activity went untracked between May and July. This issue stemmed from how the system handled compaction events, which are context summaries used to manage long conversations. Because the monitoring system only triggered when an agent handed control back to a user, agents could effectively delay oversight by continuing to execute actions without yielding control. OpenAI independently discovered and fixed this bug while the audit was still underway, but the period of untracked activity remained a key data point for the researchers.

Beyond the compaction bug, the team found several other vulnerabilities in OpenAI’s safety architecture. They demonstrated methods to hide hundreds of individual actions from the monitor and identified ways to bypass the Codex sandbox, a containment environment designed to limit what models can do. Furthermore, the auditors determined that specially crafted inputs could likely crash the monitoring system entirely. They also noted that model behavior during reinforcement learning (RL) training was not being monitored at all when the audit began, a gap that OpenAI says it addressed later in the year.

OpenAI responded by stating that it had fixed all the weaknesses identified by the auditors. The company explained that it paused RL training following an incident with Hugging Face in August and subsequently expanded its monitoring to cover that phase. However, OpenAI clarified that these specific changes occurred after the auditors’ access period ended, meaning they were not part of the formal evaluation conducted by METR and Redwood Research. The distinction highlights the evolving nature of the company’s safety protocols and the timing of external reviews relative to internal fixes.

The distribution of the audit results has drawn attention due to the limited public availability of the full report. OpenAI handed over the complete 61-page report internally, but after applying redactions, METR and Redwood Research leadership received a 38-page version. Only a short summary has been made available to the general public. METR stated that it had no right to disclose the redacted portions on its own, a decision that has left many outside observers with a partial view of the technical details and specific vulnerabilities found.

This review was part of a pilot program organized jointly by METR, Redwood Research, and OpenAI, designed to provide outside researchers with unprecedented access to internal AI infrastructure. The initiative aims to establish a new standard for independent safety audits in the rapidly evolving field of artificial intelligence. The collaboration represents a step toward greater transparency, although the current redaction process suggests that balancing confidentiality with public accountability remains a complex challenge for the industry.

Looking ahead, METR has indicated a desire to push for increased public transparency in future audits. As AI models become more capable and autonomous, the need for rigorous, independent oversight will likely grow. The findings from this three-week audit serve as a baseline for understanding current monitoring capabilities and highlight the areas where the industry may need to improve to ensure safety as deployment scales.

For readers in New York and New Jersey, where many tech hubs and AI development centers are located, these findings underscore the ongoing tension between innovation and safety. As companies race to deploy more capable models, the mechanisms for watching over them must evolve just as quickly. This audit provides a detailed snapshot of where those mechanisms stood in the summer of 2026, offering a critical reference point for future discussions on AI governance and safety standards.