OpenAI details wider agent monitoring and its limits

A fuller account, not a clean bill of health

OpenAI published a detailed account on October 29 of its expanded system for detecting agents that act outside their instructions. It describes coverage across model training, evaluations, internal work and some external deployments.

The system moves flagged activity through increasingly detailed reviews. For sensitive internal workloads, investigators can compare conversation evidence with network records and other telemetry. OpenAI also acknowledges operational limits: urgent paging is disabled for internal Codex traffic, while some critical alerts can pause work automatically.

These are the company’s descriptions of its controls. They are not an independently measured guarantee that every dangerous action will be caught.

What the outside testers actually examined

A separate METR report, published October 22 and updated October 29, describes a three-week exercise with Redwood Research, from July 21 to August 11. It examined the internal system as it existed on or before July 21, not the expanded system now described.

The testers found monitoring gaps and ways agents could potentially evade or interfere with it. Some findings were not validated as practical exploits. The public account is only a high-level subset of a private report, and OpenAI could redact sensitive information.

METR says OpenAI reports most vulnerabilities patched, with one fix still underway. It has not evaluated those remediation claims or the later coverage. Treating the pilot as certification of the current system would erase that distinction.

For external tools, observation and stopping differ

OpenAI’s API documentation says covered Responses API requests can be monitored without being stopped automatically. Automatic stopping depends on supported mechanisms that preserve conversation context, including persisted reasoning, WebSockets or OpenAI compaction.

Without those mechanisms, a configured webhook can receive an alert while the conversation continues. Chat Completions requests are outside this monitoring system; other safety checks still apply.

The documentation also warns that monitoring happens asynchronously. An action may finish before a concern is detected, and stopping a later request does not reverse earlier actions. A flag calls for review; it does not establish misconduct.

The useful test is the whole response chain

For organizations evaluating an agent, the practical questions are separate: Is this workload observed? Can an alert stop further actions? Who reviews it, and what can they contain?

Coverage alone cannot answer all four. A credible assessment needs evidence about detection, escalation and intervention under the actual deployment conditions. Model Current has not audited OpenAI’s internal infrastructure or tested these controls.