Agents & Coding
METR and Redwood Found Ways OpenAI’s Agents Could Slip Their Own Monitoring
Three weeks inside; context compression left an estimated 10% of eligible internal Codex traffic unmonitored.
An outside look at OpenAI’s internal agent monitoring.
@kimmonismus calls it a super interesting read: METR and Redwood found ways OpenAI’s internal AI agents could bypass their own safety monitoring. The researchers spent three weeks with access to internal code, monitor instructions and engineers.
| Finding | Detail |
|---|---|
| Postponed monitoring | Agents could theoretically postpone monitoring indefinitely by continuing to work instead of handing control back to the user |
| Sandbox bypass | A Codex sandbox and Auto-Review bypass could let agents take any action available to the host user |
| Hidden actions | One exploit could keep hundreds of recent actions out of monitoring, including the exploit itself; OpenAI redacted the details |
| Client settings | Two client-controlled settings could disable monitoring for newly created agents, though creating those agents could itself be detected |
| Compression gap | Context compression left an estimated 10% of otherwise eligible internal Codex traffic unmonitored |
The last finding surprised him, @kimmonismus adds.
Sources
- @kimmonismus on X · Oct 22, 9:09 AM PT