Blind Spots: New Audit Exposes Significant Gaps in OpenAI’s Safety Net

The central tension in the latest audit of OpenAI’s internal operations is not the existence of safety controls, but the significant blind spots that allowed advanced AI models to operate outside of them. A detailed review conducted by researchers from METR and Redwood Research has highlighted substantial weaknesses in the company’s ability to monitor its most capable systems. The findings suggest that while safeguards are in place, they are not as comprehensive or robust as previously assumed, raising questions about the reliability of current monitoring frameworks for frontier AI.

The significance of this audit lies in its depth and the specific nature of the vulnerabilities discovered. For the first time, outside researchers were granted deep access to OpenAI’s codebase and internal documentation. This level of scrutiny revealed that the company’s safety mechanisms, while functional in many areas, contained gaps that could allow for unmonitored behavior in its most advanced models. The report provides a rare, granular look at how these systems fail in practice, moving beyond theoretical risks to documented technical shortcomings.

The timeline of this investigation began in late July 2026, when the audit team commenced their three-week on-site review. From July 21 to August 11, the researchers had full access to OpenAI’s internal infrastructure. They interviewed approximately a dozen employees and analyzed the codebase to understand how the company monitored its agentic systems. This period coincided with a phase of rapid development, making the findings particularly relevant to the current state of AI safety practices.

The most striking finding was that a significant portion of internal traffic from GPT-5.5 class models and above was not covered by monitoring at all. METR estimates that between 6 and 25 percent of this traffic operated without oversight during the audit period. While the researchers noted that this estimate carries significant uncertainty in both directions, the potential scale of the gap is substantial. This suggests that a non-trivial amount of high-level AI activity was proceeding without the safety checks that the company had presumably designed to govern such operations.

Further analysis revealed specific technical failures that compounded these blind spots. For internal Codex traffic, which was supposed to be monitored, approximately 10 percent of activity went untracked between May and July due to a bug in how the system handled context summaries, or compaction events. OpenAI independently identified and fixed this bug during the audit, but the researchers noted that the system’s design allowed agents to delay oversight by continuing to execute actions rather than handing control back to the user. This created a window where agents could sidestep monitoring simply by not pausing.

The auditors also identified methods to hide hundreds of actions from the monitor and bypass the Codex sandbox entirely. They determined that specially crafted inputs could likely crash the monitoring system, and that model behavior during reinforcement learning (RL) training was not being monitored at the start of the audit. OpenAI stated that it paused RL training after an incident in August and expanded monitoring to cover it, but these changes occurred after the auditors’ access period ended and were therefore not part of the formal evaluation.

Looking ahead, the transparency of the findings remains a point of contention. OpenAI has stated that it has fixed all the weaknesses identified by the auditors. The full 61-page report was provided internally, but after redactions, METR and Redwood Research leadership received a 38-page version. Only a short summary was released to the public, with METR noting it had no right to disclose the redacted portions on its own. This pilot program, organized jointly by the three parties, was designed to give outside researchers deep access to internal infrastructure. For future audits, METR has indicated a desire to push for greater public transparency, suggesting that the current model of disclosure may need to evolve to meet the growing complexity of AI safety.

The implications of this audit extend beyond OpenAI, offering a benchmark for how other organizations might approach the monitoring of advanced AI systems. The discovery of these gaps underscores the need for continuous, rigorous testing of safety mechanisms. As AI capabilities grow, the margin for error in monitoring systems shrinks. This report serves as a critical data point in the ongoing effort to ensure that as AI becomes more autonomous, the systems designed to keep it in check remain equally capable and transparent.