External Review Finds Flaws in OpenAI’s Agent Monitoring System
METR and Redwood Research identified ways AI agents could evade OpenAI’s safeguards, including an exploit that could conceal hundreds of actions from monitoring.
Topics
News
- External Review Finds Flaws in OpenAI’s Agent Monitoring System
- Microsoft AI System Outperforms General Physicians in Diagnostic Tests
- How Sundar Pichai Uses AI Agents to Track Google Operations
- Tech Mahindra Partners With SpaceXSI to Scale AI-Powered Coding
- Barclays to Cut 5,000 Jobs as AI Drives Cost Savings
- CERT-In Warns of Compromised eMudhra Certificate Authority Keys
AI safety groups METR and Redwood Research identified vulnerabilities in OpenAI’s internal agent-monitoring system, including an exploit that could hide hundreds of recent agent actions from review.
The findings came from a three-week pilot conducted between July 21 and August 11, according to a joint disclosure published by METR on October 22.
One researcher from each organization was granted access to OpenAI’s codebase, monitoring prompts, configuration files and internal documentation. They also interviewed about a dozen employees while working on company-issued devices at OpenAI’s premises.
One exploit could have concealed hundreds of an agent’s recent actions, including those used to carry out the exploit. OpenAI withheld technical details from the public report.
The researchers also identified a potential way for Codex agents to bypass sandbox restrictions and OpenAI’s Auto-Review system, potentially allowing them to perform actions permitted to the user running the agent.
Other weaknesses included client-controlled headers that could disable monitoring for new agents and differences in how information was presented to agents and monitors.
The review covered OpenAI’s monitoring infrastructure as it existed on or before July 21. The evaluators cautioned that OpenAI was expanding its safeguards during the assessment, so the findings may not reflect current coverage.
OpenAI said it has patched all identified vulnerabilities affecting production safeguards, although METR and Redwood have not independently verified the fixes.
The evaluators submitted a 61-page internal report but published a shorter account under an agreement allowing OpenAI to redact sensitive information.
METR and Redwood said future evaluations should provide greater transparency about access restrictions and company-requested redactions.
