OpenAI Safety Review Finds Vulnerabilities That Could Hide Hundreds of AI Agent Actions

OpenAI's internal AI safety monitoring system contained vulnerabilities that could have allowed AI agents to conceal hundreds of recent actions from oversight, according to an independent pilot review by nonprofit evaluators METR and Redwood Research, raising questions about existing safeguards' ability to reliably track autonomous AI systems.

The findings emerged from a three-week exercise designed to test how OpenAI could provide external researchers with deep access to its internal infrastructure. The review represents a step towards greater independent scrutiny of advanced AI systems, as companies face mounting pressure to demonstrate that their safety controls can identify potentially misaligned behavior before it causes harm.

METR and Redwood said they identified several "novel vulnerabilities" in OpenAI's internal monitoring system, including an exploit that would allow agents to prevent "hundreds" of recent actions from being monitored. OpenAI told the evaluators that it had patched the identified vulnerabilities affecting its production safeguards, according to the organizations' joint statement.

The assessment was conducted from July 21 to August 11. One employee from each organization received access to OpenAI's internal codebase, documentation, and selected technical staff. The researchers were supervised while on site and used devices supplied by OpenAI that, according to the release, "never left the premises."

The evaluators shared a 61-page internal report with OpenAI but said the exercise was not intended to provide comprehensive public disclosure of the company's monitoring architecture. They therefore agreed to publish only a high-level account of their findings, with further details from future exercises expected to be made public.

"This collaboration builds on our longstanding commitment to pioneering new approaches to third-party testing, and we're using what we learned to strengthen our safeguards and shape future collaborations with independent evaluators," an OpenAI spokesperson told CNBC.

The findings underpin a major challenge for AI safety: monitoring systems must not only detect undesirable behavior but also remain effective when the models and agents they oversee become more capable of navigating complex environments and carrying out sequences of actions.

Monitoring Weaknesses Expose a Challenge for AI Oversight

METR and Redwood stress-tested OpenAI's internal misalignment monitoring system, which is intended to help identify behavior that does not align with human interests and values. The evaluators assessed the system as it existed on and before July 21, while noting that OpenAI was expanding it during the exercise.

The reported exploit is significant because an oversight system that fails to record or monitor recent actions may leave investigators with an incomplete picture of what an AI agent has done. If actions can be concealed from monitoring, operators may struggle to reconstruct a sequence of events, identify the source of an error, or determine whether a system behaved inappropriately.

The report does not establish that the vulnerabilities were exploited in a real-world incident, nor does the public summary provide enough detail to assess the precise circumstances in which the exploit could work. It does, however, demonstrate why independent testing is important: safeguards that appear effective under normal operation may contain weaknesses that become apparent only when researchers deliberately try to defeat them.

As AI systems take on more complex tasks, monitoring becomes more difficult. An agent may interact with multiple tools, perform numerous intermediate steps, and make decisions that are not immediately visible in its final output. Effective oversight therefore requires more than evaluating the answer delivered to a user. It also requires reliable ways to inspect the actions taken along the way.

The issue especially matters for systems that can execute code, access information, or operate software on a user's behalf. If monitoring cannot capture relevant actions consistently, an organization's ability to investigate failures and enforce safety policies may be weakened.

OpenAI's reported patches address the identified vulnerabilities affecting production safeguards, but the pilot also points to the need for continued testing as monitoring systems evolve. The evaluators noted that the system was being expanded during the review, meaning their findings describe a particular stage of its development rather than necessarily representing its current configuration in full.

OpenAI Expands Access for Independent Safety Researchers

The pilot forms part of a broader effort by OpenAI to establish deeper working relationships with independent safety organizations.

Chief Executive Sam Altman pledged in September to give external evaluators "employee-like access" to the company after Anthropic Chief Executive Dario Amodei proposed the approach as part of a plan to slow the pace of AI development.

OpenAI said earlier this month that it was "actively finalizing contracts with third-party safety assessors." The collaboration with METR and Redwood provides an early example of how such access can work in practice, allowing outside researchers to inspect internal systems rather than relying exclusively on information released by the company itself.

AI developers have incentives to demonstrate progress and reassure customers, investors, and policymakers that their systems are safe. Independent evaluators can bring additional scrutiny, although the value of their work depends on the scope of access they receive, the freedom to report their findings and the resources available to challenge a developer's claims.

In this case, the evaluators received access to source code, documentation, and technical personnel, but the work was conducted under controlled conditions. The decision to publish only a high-level account also limits what the public can independently assess about the vulnerabilities and the effectiveness of the fixes.

The arrangement shows that there is tension between providing enough detail for meaningful accountability and withholding technical information that could expose weaknesses in production systems. A public report containing precise exploitation methods could create additional security risks, while a report that is too general may leave outside observers unable to judge the severity of the findings.

METR and Redwood said the pilot was not designed to deliver robust public transparency about OpenAI's monitoring system. They expect to share more details about future exercises, suggesting that the current review is an initial step rather than a comprehensive public audit.

Independent AI Evaluation Faces Questions Over Funding and Accountability

The push for external assessment is gaining support as governments and AI companies debate how to oversee capable models without relying entirely on voluntary assurances from developers.

US President Donald Trump, whose administration has taken a relatively light-touch approach to AI regulation, has encouraged AI companies to "partner with an independent external auditor or evaluator" through a voluntary accord presented at the White House. Amodei signed the accord, alongside senior executives from Google, Meta, OpenAI, SpaceX and Nvidia.

Anthropic has also announced agreements with organizations including Accenture, METR and SecureBio, illustrating how independent evaluation is becoming a more visible component of AI companies' safety programmes.

However, the expansion of the sector raises questions about how independent evaluators will be funded and to whom they will report. Organizations that depend financially on the companies they assess may face concerns about conflicts of interest, even when their researchers have technical expertise and formal access to internal systems.

Access alone does not guarantee independence. Evaluators also need sufficient time and resources to test systems thoroughly, clear arrangements governing what they can publish, and the ability to communicate material findings without undue influence from the company being assessed.

The OpenAI pilot demonstrates both the potential value and the limitations of the emerging model. External researchers found vulnerabilities that the company says have been patched, providing a concrete example of how third-party scrutiny can contribute to stronger safeguards. Yet the limited public disclosure means outsiders cannot fully assess the findings, the testing methodology, or the remediation process.

As AI agents become more capable of taking actions across digital environments, the reliability of monitoring systems will be as important as the policies governing their behavior. The challenge for the industry is to ensure that safety controls can withstand deliberate testing, that weaknesses are corrected promptly and that independent assessments provide meaningful accountability rather than simply reinforcing developers' own assurances.

OpenAI's collaboration with METR and Redwood marks progress towards that model, but the vulnerabilities identified in the pilot also show why oversight must remain an ongoing process. A monitoring system cannot be considered dependable simply because it exists; its ability to detect and record undesirable behavior must be tested repeatedly as the underlying technology changes.