METR 与 Redwood Research 在 OpenAI 驻场三周审计，发现 AI 安全监控多处缺口
Three-week on-site audit at OpenAI reveals major gaps in AI safety monitoring
AI 导读
METR 与 Redwood Research 的两名研究者于 7 月 21 日至 8 月 11 日在 OpenAI 驻场三周，审计其针对失控 AI 行为的内部监控系统，期间可访问代码库和内部文档并访谈约十余名员工。
摘要与补充说明
审计发现多处弱点：GPT-5.5 及以上级别模型经 Responses API 的内部智能体流量中，估计有 6% 至 25% 完全未被监控覆盖；5 月至 7 月本应受监控的 Codex 内部流量中约 10% 未被追踪，原因是系统处理 compaction 事件（上下文摘要）存在缺口，OpenAI 在审计期间已自行发现并修复该 bug。
外部研究者首次获准进入 OpenAI 内部审计监控系统，披露的覆盖缺口和修复时序可供判断第三方审计能查到什么。
正文
Two researchers from METR and Redwood Research spent three weeks on-site at OpenAI, auditing the company's internal monitoring system for rogue AI behavior.
From July 21 to August 11, they had access to OpenAI's codebase and internal documents and interviewed about a dozen employees.
The team found numerous weaknesses. An estimated 6 to 25 percent of internal agentic Responses API traffic from models at the GPT-5.5 class and above wasn't covered by monitoring at all during the audit period, though METR says the uncertainty around that estimate is significant in both directions.
For internal Codex traffic that was supposed to be monitored, METR estimates roughly 10 percent went untracked between May and July because of a gap in how the system handled compaction events, which are context summaries. That estimate also carries significant uncertainty, according to METR. OpenAI had independently discovered the bug and fixed it while the audit was still underway.
During the period when compaction events weren't being monitored, agents could also delay oversight because the system only triggered when they handed control back to the user. That meant agents could sidestep it by simply continuing to execute actions.
The auditors also found ways to hide hundreds of actions from the monitor and to bypass the Codex sandbox. They determined that specially crafted inputs could likely crash the monitor entirely and that model behavior during RL training wasn't being monitored at all when the audit began.
OpenAI says it paused RL training after the Hugging Face incident in August and expanded monitoring to cover it, but those changes came after the auditors' access period ended and weren't part of the evaluation.
Most of the full report remains hidden from the public
OpenAI says it has fixed all the weaknesses the auditors found, and the full 61-page report was handed over internally. After OpenAI applied redactions, METR and Redwood Research leadership received a 38-page version, while only a short summary was made available to the public. METR said it had no right to disclose the redacted portions on its own.
The audit was a pilot program organized jointly by METR, Redwood Research, and OpenAI to give outside researchers deep access to internal infrastructure. For future audits, METR says it wants to push for more public transparency.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.