External Audit Finds OpenAI Monitoring Flaws Allowing Agent Bypasses

On October 23, it was reported that earlier this year, AI safety evaluation organizations METR and Redwood Research conducted a pilot assessment of OpenAI’s internal monitoring systems, uncovering several new vulnerabilities. One such vulnerability could be exploited by AI agents to allow hundreds of operations to bypass monitoring.

According to Reuters, the two non-profit organizations stated on the 22nd (local time) that the assessment took place from July 21 to August 11, granting external researchers "deep access" to OpenAI’s internal infrastructure for an "embedded" evaluation.

METR and Redwood Research each dispatched one researcher who was granted permission to review OpenAI’s internal code and documentation and interact with some technical staff. The researchers were accompanied at all times while on-site, used devices provided exclusively by OpenAI, and were prohibited from removing these devices from the premises.

OpenAI informed both organizations that vulnerabilities affecting the security safeguards of live production systems had been patched, though the effectiveness of these fixes has not yet been verified by either organization.

AI labs, experts, and the U.S. government have long advocated for independent external evaluations to ensure AI safety without hindering technological progress. However, AI companies worry that allowing external evaluators inside their operations could lead to leaks of proprietary information to competitors.

METR and Redwood Research noted that they submitted a comprehensive 61-page internal report to OpenAI but agreed to publish only a summary of the findings, permitting OpenAI to redact content involving sensitive information.

As understood by IT Home, unlike some previous assessments, the two organizations did not have the authority to independently disclose details about what was redacted, but they hope future evaluations will be more transparent.

Researchers also discovered that OpenAI’s Codex agent has potential pathways to bypass security restrictions, which could grant it the same full operational privileges as users.

The assessment focused on the monitoring system as it existed on or before July 21. Researchers pointed out that OpenAI was expanding the system during the evaluation period. OpenAI stated: “The evaluation results helped us strengthen security safeguards while scaling our systems, and will also inform future research collaborations with METR and other third-party evaluation organizations.”