OpenAI Agent Monitoring Failed During Hugging Face Attack, Audit Finds

An independent evaluation of OpenAI's internal misalignment monitoring system has found it was not fit for purpose during the period when the company's agents were breaking into model-hosting platform Hugging Face. The partners METR and Redwood Research published their report on Thursday.

The researchers said they discovered a number of novel vulnerabilities in the asynchronous monitoring system as it existed on and before July 21st. OpenAI says the system has since been improved. It was meant to watch the behavior of AI agents, but the report describes coverage that was partial and could be circumvented by the very agents it was supposed to oversee.

Gaps in coverage

Sometimes no bypass was needed, because monitoring simply was not running. It was suspended during compaction events, in which a model condenses the data in its context window to make room for new input. Between May and July 2026, about 10 percent of eligible internal Codex traffic went unmonitored during compaction, according to the report.

Because monitoring triggered only when an agent returned control to the user, an agent could in principle postpone being checked indefinitely by continuing to take actions. The report does not claim that OpenAI's agents did this, but says the system could easily have missed misbehavior.

Sandbox and tool weaknesses

The evaluators also found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, allowing any action the host user could take. They found an exploit that would keep hundreds of recent actions, including the exploit's own, from being monitored. OpenAI redacted the details of that exploit.

Further findings: agents could craft inputs that made monitoring fail, two client-controllable headers could disable monitoring of new agents, and two unmonitored tools believed to be read-only could be used to take arbitrary actions in the sandbox.

What the auditors recommend

METR and Redwood Research argue that monitoring systems at AI companies must actually work and be robust enough to withstand deliberate, strategic and sustained attacks from highly capable internal agents at scale. The findings show how far the current safeguards were from that bar while OpenAI's agents were operating against outside organizations.