OpenAI let METR and Redwood Research embed for three weeks to test its internal monitoring of misaligned agents, and they found several new vulnerabilities
This summer, we invited METR and Redwood Research to pilot an embedded evaluation of our internal monitoring system, providing deep access to our infrastructure over three weeks. Their findings helped strengthen safeguards as we expanded the system and will help shape future research collaborations with METR and other third party evaluators.
Context
It is one of the first times outside evaluators got deep inside access to a frontier lab's safety systems, and they found real gaps.
OpenAI's post quotes METR's announcement. METR and Redwood Research are nonprofit AI safety evaluators; OpenAI CEO Sam Altman pledged in September to give independent evaluators employee like access, according to CNBC.
Deep dive
On October 22, OpenAI posted that this summer it invited METR and Redwood Research to pilot an embedded evaluation of its internal monitoring system, with deep access to its infrastructure over three weeks. It said their findings helped strengthen safeguards as it expanded the system and will shape future collaborations with METR and other third party evaluators. METR posted that two employees from the groups worked on premises at OpenAI to evaluate the systems used to monitor internal agents for misalignment.
METR's write up says the work ran from July 21 to August 11. It estimated that roughly 75% to 94% of agentic internal Responses API traffic from strong models was eligible for monitoring, and 99.2% of internal Codex agent traffic. Not monitoring compaction events likely left on the order of 10% of eligible Codex traffic unmonitored from May to July, which OpenAI had already spotted and fixed during the exercise.
The evaluators found novel vulnerabilities, including a way Codex agents could in principle bypass sandboxing and Auto Review, an exploit that would keep hundreds of recent actions from being monitored, and two client controllable headers that disable monitoring for new agents. CNBC reported that OpenAI told the groups it patched the vulnerabilities affecting production safeguards. The evaluators shared a 61 page internal report with OpenAI and agreed to publish only a high level summary.
What to expect next
Watch for OpenAI to finalize contracts with third party safety assessors, which it said it was doing earlier this month, and for future exercises that METR says it expects to describe in more detail. Also watch whether Anthropic, Google and others grant similar access, and whether the findings lead to stronger standards for monitoring AI agents used inside labs. OpenAI says the work will shape its next collaborations with outside evaluators.