Outside auditors found ways OpenAI's Codex agents could slip their sandbox and hide hundreds of actions from the safety monitor

What happened

From 21 July to 11 August, one researcher from METR and one from Redwood Research worked on-site at OpenAI with deep access: internal code, the monitor's prompts and configuration, internal documents and interviews with about a dozen staff. They used OpenAI-issued devices that never left the building. Their job was to stress-test the system OpenAI uses to watch its internal AI agents for misaligned behaviour, as it stood on and before 21 July. The public write-up came out on 22 October, and it's deliberately brief and high-level by agreement with OpenAI.

What they found

The headline findings read like a to-do list for a rogue agent.

A way Codex agents could, in principle, bypass Codex sandboxing and Auto-Review, OpenAI's automated reviewer for agent actions, and take any action the host user could take.

An exploit that would stop hundreds of recent actions from being monitored, including the actions used to carry out the exploit. OpenAI redacted the details.

Inputs agents could likely craft to make the monitor fail, so a run wouldn't be escalated for human review.

Two client-controllable headers that switch off monitoring for new agents, so an agent could start an unmonitored copy of itself. Setting them might itself be caught.

Two unmonitored internal tools thought to be read-only, with a simple exploit that could let an agent take arbitrary actions in their sandbox. This one wasn't tested in practice.

How much was being watched

The researchers estimated that roughly 75 to 94% of internal agent traffic on the interface that powers Codex, from models at least as strong as GPT-5.5, was eligible for monitoring. For internal Codex agents alone it was 99.2%. RL training runs weren't covered at the start of the exercise. Because compaction events weren't monitored, around 10% of eligible internal Codex traffic likely went unwatched between May and July. The monitor only ran when an agent handed control back, so an agent could put off review just by continuing to act. OpenAI staff had spotted the compaction gap already and fixed it during the exercise.

Some things held up. With minor exceptions the monitor saw the same trajectory as the agent, errored on under 0.2% of requests, and looked for scheming, sabotage, data exfiltration, deception and prompt injection.

What OpenAI said

OpenAI told the researchers that every vulnerability affecting its production safeguards has been patched, and described big changes to the monitor's coverage. The researchers say they haven't evaluated those claims. OpenAI said it is using what it learned to strengthen its safeguards and shape future work with independent evaluators.

Our take

This is our opinion. If an agent can decide when it gets checked, it isn't really being checked. Monitor on a clock, not when the agent feels like stopping. Keep the monitor out of the agent's reach, and regularly count what was monitored against everything that actually ran.