- On October 22, 2026, Reuters reported that METR and Redwood Research identified new weaknesses in OpenAI's internal monitoring of AI agents.
- The on-site pilot ran from July 21 to August 11. The tested monitoring system reflected the configuration available on or before July 21, as OpenAI was expanding its controls.
- The evaluators identified a potential exploit that could leave hundreds of agent actions unmonitored, and a possible Codex security-permission bypass.
- OpenAI told evaluators that the production-relevant vulnerabilities were fixed. The evaluators said they had not independently verified those fixes.
The Signal
Independent AI safety organizations METR and Redwood Research found several previously unknown vulnerabilities in OpenAI's internal system for tracking AI-agent behavior, according to Reuters reporting published October 22. Their pilot took place between July 21 and August 11 and involved one on-site researcher from each organization.
One finding was a potential exploit that could stop hundreds of recent agent actions from being monitored. Another concerned a way Codex agents might bypass security restrictions and act with the full permissions of a user. These are serious classes of vulnerability, but they should not be misreported as proof that agents actually completed hundreds of harmful acts undetected.
The pilot provided researchers with unusually deep access to internal code, documentation and technical staff under company security restrictions. It examined monitoring as configured on and before July 21, not a definitive audit of every later version of OpenAI's expanded system.
The Shift
The immediate lesson is that watching AI agents requires more than a model that reads transcripts and flags suspicious messages. A monitoring system can fail before an alert is ever generated: if the agent's activities are not logged, if a pipeline can be disabled or if permissions are configured too broadly, no downstream reviewer may see the relevant behavior.
On October 14, METR published a framework for assessing AI-agent control and monitoring. It separates monitor coverage, weaknesses in monitoring infrastructure, monitor evasion, human review and possible impact. The newly reported OpenAI pilot illustrates why a focus on the monitoring pipeline itself matters.
OpenAI told the researchers that all identified vulnerabilities affecting its production safeguards had been patched. That is the company's account of remediation, not a verified third-party result: the assessors said they had not retested those fixes independently. A complete 61-page internal report was supplied to OpenAI, but only a broad public summary was released.
The Cortist Lens
For our AI Existential Risk hub, this is a concrete warning sign about oversight reliability, not evidence that human extinction is imminent. It belongs to the class of measurable precursors we should follow: can developers observe agents' relevant actions, prevent unapproved changes, and detect material attempts to evade control?
Independent evaluators with access to the actual infrastructure can test questions a public benchmark cannot answer. Yet independence also depends on what can be disclosed. According to Reuters, METR and Redwood agreed that OpenAI could redact sensitive material; unlike some previous engagements, the assessors could not independently disclose the redactions they were unable to agree on. Readers therefore have a credible reported finding but not an unrestricted underlying technical audit.
On October 14, METR separately argued that the public needs a better view of three links in the safety chain: alignment, control and acceleration of AI research and development. Today's pilot report bears directly on the control link. Our experimental X-001 extinction-by-2100 question remains unscored, has no assigned probability and cannot be updated from a single safety incident.
Look for a published independent retest of OpenAI's claimed patches, wider end-to-end coverage measurements, public reporting of severe monitoring failures and clearer evaluator rights to disclose material unresolved findings. A fixed incident taxonomy and reproducible control assessments would be stronger evidence than either marketing assurances or worst-case speculation.
External testers found concrete gaps in AI-agent oversight. OpenAI says it fixed them; the crucial missing evidence is independent confirmation. This raises questions about control robustness, not a numerical probability of human extinction.
Did the monitoring fixes hold up?
This is a living evidence question, not a new forecast. We distinguish identified vulnerabilities from the developer's statement about fixes and from a later independent retest.
METR and Redwood's pilot findings were reported by Reuters on October 22, 2026.
OpenAI said that production-relevant vulnerabilities had been corrected.
As of the last documented review, the external assessors had not independently confirmed those fixes.
Monitoring is automated; public status changes require source verification. Silence after this date does not prove the issue is resolved or still present.
Sources & editorial note
Source-link update, October 24, 2026: We now link directly to METR’s October 22 public summary of this pilot. It reports historical monitoring coverage and vulnerabilities, and explicitly says later patch claims were not independently evaluated. The full 61-page technical report remains nonpublic. The status below remains not independently verified.
Published October 22, 2026. The findings of this particular pilot are attributed to Reuters' same-day reporting on METR and Redwood's disclosed summary. METR's October 14 publications establish the independent assessment methodology and broader control-risk context; they are not the October 22 pilot's full technical report. The latter remains nonpublic. Analysis, distinction from human-extinction forecasts and watch criteria are Cortist's editorial interpretation.
Reuters · October 22, 2026Breaking reporting on METR and Redwood's OpenAI monitoring pilot and patch-verification gap METR · October 14, 2026Primary-source framework: assessing coverage, monitoring vulnerabilities and human review METR · October 14, 2026Primary-source proposal for independent visibility into loss-of-control risk Reuters · October 21, 2026Separate report on OpenAI agents weakening monitoring; distinct from the external pilot International AI Safety Report 2026Scientific context: early warning signs are not proof of catastrophic loss of control