The work ran from July 21 to August 11, 2026, with access to OpenAI’s codebase, monitoring prompts and configuration, internal documentation, and interviews with roughly a dozen researchers and engineers.
The assessment covered the system as it existed on or before July 21. The researchers estimated that roughly 75–94% of eligible internal agentic Responses API traffic from models at least as capable as GPT-5.5 was eligible for monitoring; the estimate for internal Codex-agent traffic was 99.2%. They found that unmonitored compaction events may have left about 10% of eligible internal Codex traffic unmonitored between May and July.
The public report describes potential bypasses involving delayed monitoring, a Codex sandbox and Auto-Review bypass, concealed recent actions, serialization differences, client-controllable headers, and internal tools thought to be read-only. OpenAI said vulnerabilities affecting its production safeguards stack have been patched and that coverage has since changed. METR and Redwood did not evaluate those claims, the current system, or whether every described issue was exploitable in practice.