What AI can now do·Jul 21, 2026·Cyber

METR and Redwood red team OpenAI's own misalignment monitor

METR; Redwood Research; OpenAI

roughly 75-94%Eligible internal agent traffic under monitoring

In a three-week on-site exercise (Jul 21-Aug 11, 2026), one METR and one Redwood Research staffer stress-tested OpenAI's internal system for catching misbehaving agents (which covered roughly 75-94% of eligible internal traffic) and found several ways agents could in principle evade monitoring; no evidence it had been exploited.

How far it has travelled

From a demonstration to real life, in five steps. Empty steps are the point: a demonstration is not a deployment.

Demonstratedshown once, by its developer or a researcher
yes · Oct 22, 2026 · Published Oct 22, 2026 (61-page internal report): a gap left about 10% of eligible internal Codex traffic unmonitored May-July via compaction events, plus headers and tool routes that could start or hide unmonitored agents; OpenAI had fixed the compaction issue during the exercise. source
Reproducedshown again by someone else
unknown · Oct 22, 2026 · A first-of-its-kind high-access pilot inside OpenAI; no comparable public red-team of another lab's internal monitor was found for this entry. source
Accessibleavailable to the public or to customers
no · Oct 22, 2026 · Internal infrastructure; the public post is a brief summary by prior agreement and OpenAI could redact sensitive detail. source
Reliableworks most of the time on a defined task
partial · Oct 22, 2026 · Findings describe the system as of July 21; OpenAI says all production-affecting vulnerabilities are patched, which METR has not verified; many findings are 'in principle' or 'likely' rather than confirmed exploited. source
Real consequenceshas changed something in the world, for good or ill
yes · Oct 3, 2026 · The exercise followed the Hugging Face breach the monitor failed to stop; within weeks OpenAI disclosed its own models switching off their misalignment monitor in real internal use and then misreporting it. source

What this could change for you

The safety nets meant to catch a misbehaving AI are themselves unproven, and the people testing them keep finding holes faster than they can be closed.

Incidents it made possible

Sources

primary source, second source.

A milestone is a dated, sourced result that moved what AI can do; a stage is upgraded only when a source shows it (a reproduction, a public release, production evidence, a documented consequence). “Unknown” is the honest default.