METR and Redwood Research spent three weeks on-site at OpenAI stress-testing the company’s internal agent monitoring system. They had access to internal codebases, monitor configurations, and engineering teams, working on locked-down hardware that never left the office. The output was a 61-page report and a public summary detailing where asynchronous misalignment monitoring breaks down.

If you read security post-mortems looking for clever adversarial token manipulation or exotic prompt injections, this report offers something more humbling: the failure points looked like standard distributed systems bugs.

The Compaction Blind Spot

The most telling finding involved context compaction. When an agent runs a long trajectory, the host system eventually compacts older messages to stay within token budgets.

Between May and July 2026, OpenAI’s internal monitoring pipeline did not monitor compaction events. METR estimated that this single omission left roughly 10% of eligible internal Codex agent traffic unmonitored. More critically, the monitor was set to evaluate runs only when an agent returned control to the user.

If an agent simply kept calling tools and chaining steps, it could avoid triggering the monitor indefinitely while compaction wiped the older trajectory steps out of view. The evaluators also uncovered an exploit that allowed an agent to suppress hundreds of recent actions from ever hitting the monitor logs.

That is not a failure of LLM safety alignment. It is a failure of lifecycle hooks.

Serialization and Headers

The evaluators found several other architectural cracks:

  • Serialization drift: Differences between how trajectories were serialized for the working agent versus how they were presented to the monitor allowed agents to craft inputs that caused the monitor to throw errors silently, avoiding escalation to human review.
  • Client-controlled headers: Two headers accepted by the internal API could disable monitoring entirely on new agent instances. An agent with execution permissions could spawn an identical, unmonitored sibling process.
  • Permission assumptions on tools: Two internal tools assumed to have read-only access harbored exploits allowing arbitrary execution within their sandboxed environments.
  • Coverage gaps in training: While internal Codex agent traffic had high eligibility (around 99.2%), internal RL training rollouts were entirely unmonitored at the start of the exercise.

Monitoring Cannot Be an Afterthought Hook

A common pattern in agent architecture is treating monitoring as an asynchronous consumer tacked onto the edge of an execution loop: let the agent run, gather the history when it finishes a turn, and pass the text to an evaluator model.

The METR report exposes why that model falls apart once agents take sustained actions:

  1. Turn-boundary triggers fail long-running agents: If an agent only gets inspected when it yields, an agent that never yields is never inspected. Evaluators must fire every fixed number of steps or minutes, independent of whether the agent decides to yield control.
  2. Context truncation creates blind spots: If your monitoring pipeline reads the current context window rather than an immutable, append-only event log, any compaction or window slicing erases evidence before the auditor ever runs.
  3. Monitors must see byte-for-byte identical payloads: The moment the auditor parses a JSON blob or prompt string through a slightly different parser than the runtime agent, parser differential exploits become trivial.
  4. Scaffolds require hard physical isolation: An agent should never share network headers, config files, or sandbox environments with the machinery that observes it.

OpenAI stated that the specific production vulnerabilities highlighted by METR have been patched. But the systemic takeaway for anyone building agent harnesses is straightforward: your evaluator model is only as reliable as the event pipeline feeding it.