From July 21 to August 11, one employee from each organization worked onsite on OpenAI-issued devices, with access to internal code, monitor prompts and configuration, documentation, and interviews with about a dozen staff.
The exercise assessed the system as it existed on or before July 21. The researchers estimated that roughly 75–94% of eligible internal Responses API agentic traffic from models at least as capable as GPT-5.5 was eligible for monitoring; the estimate for internal Codex-agent traffic was 99.2%. They reported that RL training runs were not covered at the exercise’s start, and that unmonitored compaction events may have affected about 10% of eligible internal Codex traffic between May and July.
The team reported vulnerabilities including potential sandbox and Auto-Review bypasses, ways to prevent recent actions from being monitored, monitor failures from serialization differences, and two headers that could disable monitoring for newly created agents. OpenAI said it patched identified production-safeguard vulnerabilities. The report does not establish the current coverage or security of OpenAI’s expanded monitoring system, and the researchers did not evaluate OpenAI’s subsequent changes.