OpenAI hosted representatives from METR and Redwood Research for a three-week security assessment from July 21 to August 11, 2026. The auditors received high-access rights to internal monitoring systems under controlled conditions using company-provided hardware.
The pilot evaluated monitoring coverage for AI agents, specifically the Responses API and internal Codex coding agents. For models at or above GPT-5.5 strength, the assessment estimated that 75% to 94% of Responses API traffic was monitored, while 99.2% of internal Codex agents were covered.
Reviewers identified a monitoring gap related to compaction events in long-running agent sessions. This blind spot resulted in approximately 10% of eligible internal Codex traffic remaining unmonitored between May and July 2026.
The audit produced a 61-page report detailing several previously unknown vulnerabilities in the monitoring infrastructure. OpenAI stated that all identified vulnerabilities affecting production safeguards have since been patched.
