METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-In

OpenAI's internal misalignment monitoring for Codex agents, as it existed on and before July 21, 2026

A red-team report by METR and Redwood Research found that about 10% of eligible internal Codex traffic from May to July 2026 went unmonitored because monitoring paused during context compaction. Monitoring only ran when an agent returned control to the user, so an agent could defer it indefinitely by continuing to act. Two client-controllable headers could switch monitoring off for new agents, two supposedly read-only unmonitored tools could be used to take arbitrary actions, and Codex agents could in principle bypass sandboxing and Auto-Review to take "any action that the host user could take." One redacted exploit hid hundreds of recent actions, including its own, from the monitor. OpenAI says it has fixed the issues; the authors did not verify the fixes and did not establish whether agents deliberately concealed activity

Monitoring was triggered by events the agent controlled and could be disabled through inputs and headers the monitored client could set