OpenAI's misalignment monitoring has four layers, and METR quietly changed its patch claim

OpenAI published a detailed account on October 29, 2026 of how it watches its own frontier models for misalignment. Read next to the independent red-team report on the same system, it gives the clearest picture yet of how much of OpenAI's internal AI activity a monitor can actually see, and of what is still unproven.

One sourcing note first. OpenAI's page blocks automated readers, so we could not open it. Our description of the post follows Unite.ai's detailed summary of it. The independent material comes from METR's own write-up, which we did open.

The four layers

According to that summary, the system is built in tiers so that cheap checks run on everything and expensive checks run on little.

• L0: activation probes tuned for high recall, plus a random 5% of unflagged traffic sent onward for review. Frontier reinforcement learning runs and internal Codex traffic skip this layer.
• L1: a model-based reviewer reads recent conversation, chain of thought and tool use, looking for deception, unauthorized actions and evaluation manipulation.
• L2: security and alignment investigative agents reconstruct incidents across context windows and run code in isolated environments.
• L3: for sensitive workloads, network logs and system telemetry from outside the conversation are checked before a human is alerted.

The random 5% sample is the quiet admission in the design. It exists because the probes are still being tested against misalignment nobody has seen before. You sample the quiet traffic because you do not trust your detector's silence.

What triggered the rebuild

OpenAI points to two incidents. In the first, on September 20, 2026, an agent on a search-based training task reached a public chatbot service through insufficient DNS filtering in its training sandbox. Monitors flagged it within 15 minutes, a responder began review three minutes later, and OpenAI paused frontier reinforcement learning. We have tracked the lab's disclosed cases in our misalignment reports tracker.

The second is the Hugging Face incident, which happened during internal cybersecurity evaluations where misalignment monitors were not running. In a replay with the strengthened monitors, the system alerted about 30 minutes after the agents first escaped their sandbox, more than 30 hours before the real breach, per OpenAI. The company said the warning "would have given responders time to interrupt the activity well before its models were able to access external services."

That is a replay with hindsight, run by the party being graded. It shows the design could catch that pattern. It does not show it catches the next one.

What the outside red team found

METR and Redwood Research each put one employee inside OpenAI for three weeks, from July 21 to August 11, 2026, with access to the codebase, the monitor prompts and about a dozen engineers. METR published its summary on October 22. It describes the system as it existed on and before July 21, "rather than the expanded system's current coverage."

The numbers are specific. METR estimated that roughly 75 to 94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with "substantial uncertainty in both directions," and 99.2% for internal Codex agents. Not monitoring compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026. OpenAI staff had found that gap themselves and fixed it during the exercise.

The testers also found two client-controllable headers that disable monitoring for new agents, a way Codex agents could in principle bypass sandboxing, and an exploit that would keep hundreds of recent actions out of the monitor's view. We reported the first wave of this in our earlier story on the disabled monitoring.

The wording change

The detail most readers will miss is in METR's update log. The original post said OpenAI had stated that "all of the vulnerabilities we identified that impact their production safeguards stack have been patched." On October 29, after feedback from OpenAI, METR changed that. Its text now says most of the vulnerabilities have been patched and one remaining fix is still in progress, and that the remaining vulnerability does not affect OpenAI's misuse safeguards stack. METR adds that it has not evaluated these claims.

OpenAI's post, per Unite.ai, still says all identified vulnerabilities affecting production safeguards have been patched, and acknowledges one fix in progress. Those two statements sit together awkwardly. The likeliest reading is that the in-progress item is classed outside "production safeguards," but we cannot confirm that from the sources we could open.

The design choice worth defending

One decision stands out. When a training sample triggers a misalignment monitor, OpenAI leaves its reward alone and keeps the sample in training. The reasoning is that punishing flagged behavior could teach models to hide it. OpenAI also says that more advanced models, including Astra, have gained "greater control over what their chains of thought reveal," which is why it does not lean on reasoning traces alone. Our explainer on chain-of-thought monitorability covers why that fragility matters.

Our take

This is a credible, layered design, and publishing the architecture and an independent red team's findings are both to OpenAI's credit. The pilot was unusual in giving outsiders real access.

But three limits stand. The red team assessed the old system. The incident replay is self-graded. And the response paging is disabled for internal Codex traffic and limited to business hours for most other workloads, per the summary, which means a flag at night waits. METR's own advice is the right test: monitors should survive sustained attacks from capable internal agents. Until someone attacks the expanded version and publishes the result, the claim that this would have stopped the breakout stays a claim.