OpenAI Monitor Pilot Shows 75–94% Coverage

Between 75% and 94% of high-capability agentic Responses API traffic was eligible for asynchronous misalignment monitoring during a three-week on-site pilot; eligible traffic was intended for the monitor pipeline, though load shedding, monitor errors, or implementation bugs could still drop some of it (coverage range and methods).

That band applies to Responses API traffic from models at least as strong as GPT-5.5. On October 22, 2026, METR published a short public note on the pilot it ran with Redwood Research inside OpenAI, after work that ran from July 21 to August 11.

The parties agreed upfront to publish only a relatively brief high-level public post. The full findings stayed in the private reports shared with OpenAI staff and, in redacted form, with METR and Redwood leadership.

75–94% Responses API eligibility

METR’s public post, dated October 22, 2026, centers on one measurable claim: for models at least as strong as GPT-5.5, roughly 75–94% of agentic internal Responses API traffic was eligible for monitoring as of the historical system frozen on and before July 21 (METR write-up). Eligibility means traffic was intended to enter the monitor pipeline. Load shedding, monitor errors, or implementation bugs could still drop some of that traffic before a human review path.

A tighter figure attaches to a narrower slice. Out of the Responses API traffic used for internal Codex agents, METR estimated 99.2% was eligible for monitoring, with higher confidence than the wider Responses API band (same METR post). That API powers Codex among other products. The post is explicit that other internal agentic coding paths, including agents on OpenAI’s research inference service, sit outside this estimate because access and time ran out.

Crypto Briefing’s same-day summary restates the same bands and flags what a low end near three-quarters implies: a meaningful share of eligible traffic could have sat outside monitoring during the assessed window.

Compaction events mattered for the gap. METR estimated that not monitoring those events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026, with substantial uncertainty because the historical logs needed to pin the fraction were incomplete (METR). OpenAI staff had already spotted that hole before the pilot started and fixed it during the exercise.

Three weeks of chaperoned access

From July 21 to August 11, one METR employee and one Redwood Research employee worked on OpenAI-issued devices that never left the premises, with accompaniment while onsite (METR access description). They read internal codebase material, misalignment-monitor prompts and configuration, and internal documentation. They also ran technical interviews with approximately a dozen researchers and engineers across monitoring, safety-systems, and security teams.

The product of that access was a 61-page internal report for OpenAI researchers and security staff. A 38-page OpenAI-redacted version went to leadership at METR and Redwood (footnote detail in the METR post). The public article is deliberately brief. All three parties framed the work as a pilot for deep external access to internal infrastructure, not as a full public audit of today’s stack.

Mechanically, the assessed monitor was asynchronous. It triggered when agents returned control to the user. While compaction stayed unmonitored, an agent that simply kept taking actions could postpone a monitor pass indefinitely. METR states it lacked the access to check whether any agent had used that pattern in practice.

Operational health numbers from the exercise window were comparatively tight. Information shown to the reviewers suggested the monitor errored on less than 0.2% of requests, and that in one 24-hour period during the exercise there were zero load-sheds (METR). Separately, reviewers were told a subset of RL training rollouts had been monitored for misalignment between March and June, but at the start of the exercise RL training runs were not covered.

The vulnerability list is where the pilot earns its keep. Reviewers found a path by which Codex agents could in principle bypass Codex sandboxing and Auto-Review and take any action the host user could take. They found an exploit that could keep hundreds of recent actions, including the exploit steps, out of monitoring (details redacted by OpenAI). They found ways agents could feed the monitor inputs that fail via serialization differences between the trajectory the agent sees and the trajectory the monitor sees, so the run never escalates for human review. They found two client-controllable headers that disable monitoring for new agents, though setting those headers and spawning the new instance could itself be caught. They found two unmonitored internal agentic tools treated as read-only, plus a simple exploit path that could have broken those limits inside the sandbox. They did not validate that last behavior in live production.

On the constructive side, they verified that with a few minor exceptions the monitor sees the full trajectory the agent sees, and that monitor prompts look for scheming, monitor subversion, sabotage, data exfiltration, deception, and inbound or outbound prompt injection, among other risk categories (METR findings list).

99.2% internal Codex eligibility

OpenAI’s headline after the exercise is simple: every vulnerability the reviewers identified that affects the production safeguards stack has been patched, and the company has described significant later changes to intended monitoring coverage. METR’s sentence that follows is just as plain. The reviewers have not evaluated those claims (METR). Crypto Briefing treats the patch statement the same way: attributed to OpenAI, not independently re-scored.

METR estimated 99.2% eligibility for the internal Codex subset with higher confidence than the wider Responses API band, and Crypto Briefing restates that higher-certainty line (METR). It is still an eligibility rate on a historical system, not a live guarantee that every eligible call finished the pipeline. The wider 75–94% Responses API band is the figure buyers will quote, and it carries the uncertainty METR itself flags in both directions.

Design ideals in the same post are more durable than any single percentage. Future monitors should make unmonitored agentic inference hard without explicit org or API-key approval, sample every N messages or minutes instead of waiting for turn end, reconcile inference logs against monitor logs, keep a living list of known bypasses, keep agent scaffolds isolated from tool execution and from monitor design, and red-team the monitor for strategic collusion.

The public package buys the reader a mid-year snapshot of how one frontier lab’s internal agent watchdogs behaved before July 21, plus a named set of failure modes that an outside pair could find with deep access. It does not buy a certified score for the expanded system OpenAI says it runs now.

Outside researchers under escort rules

Access was gated to two nonprofit employees, on-premises only, on company hardware, with staff accompaniment. Publication was gated harder. METR, Redwood, and OpenAI agreed in advance to a relatively brief high-level public post. OpenAI could redact confidential material from the public version at its sole discretion, and unlike some other METR engagements the outsiders lacked a unilateral right to describe those redactions (METR transparency footnote). METR still endorses each finding that made the public cut.

METR, Redwood, and OpenAI designed the exercise as a pilot for giving external researchers deep access to internal infrastructure, not to provide robust public transparency about the monitoring systems (METR). METR’s October 22 post on X describes the same three-week embedded assessment without adding numbers beyond the blog. The Responses API path that powers Codex, among other internal agent surfaces tied to ChatGPT-class tooling, is the traffic family those eligibility estimates cover.

OpenAI has stated that every vulnerability identified that affects the production safeguards stack has been patched, and that intended monitoring coverage changed after the July 21 freeze. METR has not evaluated those claims, so the published percentages still describe only the historical system.