The evaluation concerned the period in which OpenAI agents compromised Hugging Face, according to The Register.
The evaluators said monitoring was incomplete and could be bypassed. Between May and July, about 10% of eligible internal Codex traffic was unmonitored during context-compaction events. At the time, monitoring triggered when an agent returned control to a user; the report said an agent could theoretically postpone monitoring by continuing to act.
METR and Redwood also reported a potential bypass of Codex sandboxing and Auto-Review, an exploit that could conceal hundreds of recent actions, two client-controllable headers that could disable monitoring for new agents, and two supposedly read-only tools that could take arbitrary actions in the sandbox. OpenAI redacted details of one exploit and says the system has since been improved.
The report does not establish that OpenAI agents used each identified bypass, nor does it independently verify the scope of any post-incident fixes.