METR finds gaps in OpenAI’s summer agent-monitoring system
METR has published an assessment of OpenAI’s internal agent monitoring conducted with Redwood Research during the summer. The exercise found gaps between actions eligible for scrutiny and actions actually checked, including problems around condensed conversation histories. OpenAI says production vulnerabilities have been patched; METR has not independently revalidated all of those fixes.
Artificial Intelligence··Morning
The exercise examined a summer configuration
AI evaluation organization METR published an examination of OpenAI’s internal agent monitoring on October 22. An employee of METR and an employee of Redwood Research carried out the work between July 21 and August 11. They investigated whether safeguards could detect problematic actions by agents operating inside the company. The findings describe a historical configuration; OpenAI says vulnerabilities affecting its production systems have since been patched.[1], [2]
The researchers worked on site with accompanying staff and received access to internal code, documentation and system prompts. Interviews with employees added operational context to the technical examination. The exercise yielded a 61-page report for OpenAI; a redacted version contains 38 pages. The internal and public versions concern the same assessment, with different amounts of detail cleared for release.[1]
Eligible actions did not always reach the monitor
The assessment distinguished requests eligible for monitoring from requests actually processed by a monitor. Broad eligibility therefore did not establish complete scrutiny of the agent’s activity. The researchers examined routing, monitoring errors and the way agents continued their work as connected parts of the system. A check intended to cover an action still depended on that action reaching the monitoring path in usable form.[1]
Conversation compaction created one such gap. A monitor could receive a condensed history instead of the complete preceding interaction. Missing logs also introduced uncertainty into estimates of the problem’s extent. OpenAI independently identified the same issue and fixed it during the exercise. The assessment therefore records both an observed weakness and action taken while the researchers were still conducting their examination.[1]
Turn-ending checks could be postponed
Another concern was a review performed only when an agent ended its turn. Continued activity could delay that review instead of triggering prompt scrutiny of ongoing actions. METR recommended regular monitoring intervals, clearer responsibility across systems, incident response and further red-team exercises. OpenAI’s subsequent statements about remediation remain distinct from METR’s findings: the evaluators have not independently revalidated every later fix or established the current condition of all products outside the assessed system.[1]
