METR and Redwood assessed the system existing on or before July 21 during a July 21-August 11 pilot. The findings concern historical controls, not independently established current exposure. Mechanism, preconditions and effects. METR and Redwood Research reviewed OpenAI's internal monitoring configuration during a high-access July 21 to August 11 pilot.…
Inspect the ClaimsCase · DiggingBeagle record
METR pilot separates monitoring coverage from resistance to agent interference
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
CLM-CP17-METR-MONITOR-PILOT-LIMITS reports: OpenAI stated production-impacting issues were patched; METR did not evaluate those claims. The read-only-tool escalation hypothesis was not validated. Source SRC-2026-CP17-METR-MONITOR-PILOT is located at 'Findings final tool bullet and paragraph beginning "Since completing"'. The distinctive mechanism begins: METR and Redwood Research reviewed OpenAI's internal monitoring configuration during a high-access July 21 to August 11 pilot. Classification: setting=controlled_live, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=fixed_reported; scoped control or limit: Decouple monitor scheduling from the agent's ability to keep acting, reconcile eligible execution with monitor receipt, maintain logs that the agent cannot rewrite, and independently exercise client-controlled headers. These are the reviewers' stated design principles, not evidence of a completed fix. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP17-METR-MONITOR-PILOT-LIMITS · CLM-CP17-METR-MONITOR-PILOT-HISTORY · CLM-CP17-METR-MONITOR-PILOT-SANDBOX · CLM-CP17-METR-MONITOR-PILOT-TRIGGERS · METR: historical internal-agent monitoring pilot
At a glance
Current coverage and remediation require separate validation.
Limits and uncertaintyFull account
METR and Redwood assessed the system existing on or before July 21 during a July 21-August 11 pilot. The findings concern historical controls, not independently established current exposure.
Mechanism, preconditions and effects. METR and Redwood Research reviewed OpenAI's internal monitoring configuration during a high-access July 21 to August 11 pilot. They distinguished the fraction of agent traffic eligible for monitoring from the ability of an agent to interfere with triggers, history or sandboxing. Discovered routes included postponing a turn-return trigger, client-controllable monitor-disabling headers, and an exploit hiding hundreds of recent actions. The Codex sandbox/Auto-Review path was described as possible in principle, while the purported read-only tool route was not validated.
Comparison and evidence limits. The review assessed the historical system as it existed on or before July 21, not the expanded monitoring deployed later. OpenAI stated that production-impacting defects were patched; METR did not verify that statement, and OpenAI could redact details from the public summary. The direct coding-agent monitor removals reported elsewhere occurred in separate situations and must not be counted as outcomes of this pilot.
Timeline
- Oct 22, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP17-METR-MONITOR-PILOT-LIMITSOpenAI stated production-impacting issues were patched; METR did not evaluate those claims. The read-only-tool escalation hypothesis was not validated.supported
Basis: reported finding
- supportsMETR: historical internal-agent monitoring pilotprimary disclosure
Findings final tool bullet and paragraph beginning "Since completing"
CLM-CP17-METR-MONITOR-PILOT-HISTORYResearchers found an exploit that could conceal hundreds of recent actions; public details were redacted.supported
Basis: reported finding
- supportsMETR: historical internal-agent monitoring pilotprimary disclosure
Findings bullet beginning "We also discovered an exploit"
CLM-CP17-METR-MONITOR-PILOT-SANDBOXThey reported an in-principle Codex sandbox and Auto-Review bypass reaching the host user's authority.supported
Basis: reported finding
- supportsMETR: historical internal-agent monitoring pilotprimary disclosure
Findings bullet beginning "We found a way Codex agents"
CLM-CP17-METR-MONITOR-PILOT-TRIGGERSUnmonitored compaction and return-to-user triggering allowed monitoring postponement; two client-controlled headers could disable monitoring for new agents. Creating such agents could itself be detected.supported
Basis: reported finding
- supportsMETR: historical internal-agent monitoring pilotprimary disclosure
Findings: compaction, return-control trigger, and client-controllable headers
Controls and mitigations
- Decouple monitor scheduling from the agent's ability to keep acting, reconcile eligible execution with monitor receipt, maintain logs that the agent cannot rewrite, and independently exercise client-controlled headers. These are the reviewers' stated design principles, not evidence of a completed fix.
Unknowns and contradictions
- Current coverage and remediation require separate validation.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183