Researchers find gaps in OpenAI's internal agent monitoring
A new report examines how internal coding agents could escape review in OpenAI's earlier monitoring system.
In brief: Researchers found gaps in OpenAI’s internal agent monitoring. OpenAI says affected production safeguards have since been patched.
What is being monitored?
A coding agent can do more than suggest a change. When connected to software tools, it can edit files, run commands and use the results to decide what to do next.
OpenAI, the company behind ChatGPT and Codex, uses coding agents internally. Its March description of the monitoring system explains how a separate AI system examines their activity and flags suspicious behaviour for human review. That includes attempts to work around restrictions or transfer data without permission.
This kind of review happens after activity has taken place. It serves a different purpose from a control that blocks a command before it runs.
A gap between activity and review
METR and Redwood Research reported their findings on 22 October. They assessed the system as it existed on or before 21 July. One finding: agents could postpone review by continuing to act instead of returning control to the user.
OpenAI told the researchers that vulnerabilities affecting production safeguards were patched. The researchers have not verified those fixes.
Why this matters for business use of agents
Imagine an agent working through a software repair: it opens a file, changes code, runs a check and tries again. A person may see only the final answer, although several actions have already occurred. Reviewing that answer and reviewing the sequence of actions are different jobs.
For a business letting agents work in its systems, the distinction matters because access can be used between human interactions. Understanding what an agent was allowed to do is only part of understanding what happened.
Our explanation of agent containment tests covers the related question of whether agents can cross the boundaries around their work.
