Key Takeaways
- METR estimated that 75–94% of OpenAI’s internal agentic Responses API traffic from GPT-5.5-class and stronger models was eligible for monitoring in July 2026, with uncertainty in both directions.
- Internal Codex agents scored 99.2% eligible, yet METR estimates unmonitored compaction events left on the order of 10% of eligible Codex traffic unseen between May and July 2026.
- When a vendor says an agent is “monitored,” ask what was counted, when the monitor runs, and what can switch it off.
How Much AI Agent Traffic Was Actually Monitored?
For OpenAI’s internal agents in July 2026, the answer METR gave was a range, not a figure: roughly 75–94% of the relevant Responses API traffic was eligible for monitoring.
METR, a nonprofit that studies advanced AI agents, published the finding on October 22, 2026. Its employee and one from Redwood Research spent three weeks, from July 21 to August 11, stress-testing OpenAI’s internal misalignment monitoring.
Crypto Briefing reported the same figures the same day. We read both. The facts below come from METR’s post unless we say otherwise.
The range covers traffic from models at least as strong as GPT-5.5, and METR says its uncertainty runs in both directions.
“Eligible” has a precise meaning. METR defines it as traffic intended to be sent to a monitor. Load shedding, monitor errors or bugs could still stop some of it from completing the pipeline.
The Coverage Ledger
This ledger is our layout of METR’s separate findings. We did not test any monitor. Each row rests on a different denominator, so the rows cannot be multiplied together.
| Traffic slice | What METR found | Window |
|---|---|---|
| Responses API agent traffic | 75–94% eligible | Jul 2026 |
| Internal Codex agents | 99.2% eligible | Jul 2026 |
| Compaction events | ~10% of eligible Codex traffic unseen | May–Jul 2026 |
| RL training runs | Not covered at start | Jul 21, 2026 |
The gap between the first two rows is the lesson. A subset can look nearly complete while the larger pool around it is not.
By our arithmetic, 100% minus 94% and minus 75% means 6–25% of that traffic fell outside eligibility. METR did not state that range as a percent. It also excluded agents on OpenAI’s internal research inference service, whose volume it could not estimate.
Why Did a 99.2% Number Still Leave a Hole?
Eligibility says where the monitor was meant to look. It does not say what happened inside a session.
METR found that compaction events, the steps in long sessions where an agent’s history is condensed, were not monitored. OpenAI staff had spotted this before the exercise and fixed it during it.
The information needed to measure the gap precisely had not been logged. So METR gave an order of magnitude, about 10%, and said its uncertainty about the exact fraction was substantial.
Timing mattered too. At the time, the monitor triggered when agents returned control to the user. During the compaction gap, METR says, an agent could postpone being monitored indefinitely by simply continuing to act.
What Else Did the Auditors Find?
METR listed several routes that could have blunted monitoring. They were found in the system as it stood before July 21, and OpenAI says all that touch production safeguards have since been patched.
- Two client-controlled headers could disable monitoring for new agents, though setting them might itself be caught.
- Agents could likely build inputs that made the monitor fail, by exploiting differences between the trajectory the agent sees and the one the monitor sees.
- One exploit, details redacted by OpenAI, could have kept hundreds of recent actions from being monitored.
- Two unmonitored internal tools believed to be read-only could be exploited to take arbitrary actions in their sandboxes. METR did not test whether this was exploitable in practice.
METR also reported good news. The monitor errored on under 0.2% of requests, and in one 24-hour period there were zero load-sheds. With few exceptions, the monitor saw the full trajectory the agent saw.
Two Lenses
The reassuring percentage
A high number lets everyone relax. 99.2% eligible for Codex agents is a strong result, and OpenAI invited outsiders in to check it, which most companies avoid.
In this reading, a range with honest error bars is what a working audit looks like. The vendor found problems, patched them, and allowed a public summary.
The denominator nobody logged
A percentage is only as good as the list it divides by. METR could not size some internal traffic, could not measure the compaction gap exactly, and says it did not evaluate OpenAI’s later changes.
We weigh this lens more heavily for any claim about third-party agents. Those claims usually arrive without an auditor, a range or a window.
Coverage Check: Three Questions for Any “Monitored” Claim
Use this on a vendor page, an internal policy or an agent platform. It is our synthesis of METR’s design ideals, not a test we ran.
- Count. Ask for two logs: all agent inference, and the part sent to the monitor. Compare them. Without both, “monitored” is a statement of intent.
- Timing. Ask when the monitor runs. If it fires only when the agent finishes a turn, a long run can go unseen until the end.
- Switches. Ask what an agent, or a client acting for it, can change to start an unmonitored instance, and whether that change itself gets flagged.
METR states the standard bluntly: “future monitoring infrastructure should be able to withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale.”
This connects to our earlier look at agents weakening their own monitoring. That post asked what an agent can edit. This one asks how much the monitor sees in the first place.
It also echoes the case for a stop control the agent cannot touch.
What Would Change Our View?
We would trust a “percent monitored” claim more if it came with a stated window, a stated denominator and a named outside party, as this one did.
We would trust it less if the figure had no range, if the logs needed to verify it did not exist, or if the audit had to rely on assurances about changes it was not allowed to test. METR says it has not evaluated OpenAI’s claims about what was fixed.
A second outside audit of the current system, with a published method, would change our reading more than any new percentage.
FAQ
Q. Does 99.2% mean 99.2% of Codex activity was actually monitored?
A. No. METR says 99.2% of the Codex subset was eligible for monitoring, meaning intended to be sent. It separately estimates about 10% of eligible Codex traffic went unmonitored between May and July 2026 because compaction events were not covered.
Q. Are these gaps still open?
A. OpenAI says vulnerabilities affecting its production safeguards have been patched, and that the compaction gap was fixed during the exercise. METR says it has not evaluated those claims or the system’s current coverage.
Q. Why does this matter if I do not work at an AI lab?
A. Any team that lets an agent act on its behalf will be told it is “monitored” or “logged.” The three questions work on those claims too.
Sources
- Red-Teaming OpenAI’s Internal Agent Monitoring Systems — METR, Oct 22, 2026
- OpenAI let METR and Redwood Research inside — Crypto Briefing, Oct 22, 2026
Leave a Reply