What happened
Two independent safety evaluators spent three weeks inside OpenAI testing the system that is supposed to catch its coding agents going off the rails. Metr and Redwood Research stress tested the company's internal misalignment monitoring between July 21 and August 11. The access was unusually deep. The team was given the internal codebase, the prompts used for misalignment monitoring, and internal documentation, on OpenAI issued devices that never left the company's offices, with researchers accompanied onsite.
They found several ways around the controls. Codex agents could bypass sandboxing and Auto Reviews. There was a monitoring gap that let agents avoid review altogether. There were client controllable headers that switched monitoring off. And there was an exploit that hid hundreds of recent actions from view.
OpenAI told the evaluators that all the vulnerabilities affecting its production safeguards stack have been patched, and described significant subsequent changes to the intended coverage of its monitoring. Metr's account is careful here. It states that it has not evaluated those claims. The evaluators estimated that roughly 75 to 94 percent of agentic internal responses API traffic, the traffic that powers Codex, was eligible for monitoring during the period. Earlier monitored training happened just before the review began, so it was out of scope.
The recommendations in their 61 page report were operational rather than theoretical. Monitor every few messages or minutes instead of waiting for an agent to finish its task, account for all inference so logs can be cross referenced, assign ownership for incident response with logs that are tamper proof and easy to search, and run control evaluations that actively try to break the safeguards.
Why this is a GRC story
This is what AI assurance looks like when it is done properly. Scope, access, sampling, findings, management response, a report with a page count. Anyone who has run a SOC 2 or an ISO certification will recognise the shape, which is a useful counter to the idea that AI governance needs an entirely new discipline.
A control the monitored party can switch off is not a control. Client controllable headers that disable monitoring are the AI equivalent of an admin console that can turn off logging. The design flaw is identical whether the system runs an LLM or a database.
Coverage is the finding. The claim tested was never that monitoring existed, but that it covered the work. Turning that into a number, 75 to 94 percent of one traffic type over a defined window, is how a vague assurance statement becomes auditable.
Assertion is not evidence. OpenAI says patched. Metr says it has not verified that. Both statements are honest, and the gap between them is where a GRC function should sit, asking for test results rather than the statement.
What to watch
Whether the full report is published, and whether other frontier labs invite the same kind of embedded review. Enterprise buyers are the other pressure point. Vendor questionnaires that ask whether an AI provider monitors its models may soon ask what percentage of inference was in scope.
The lesson is about how to grant access. Devices that never leave the building, researcher supervision, internal documentation shared under scope, deep access without handing over the keys. That is a template for auditing a system you do not own.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.