外部研究员进驻 OpenAI 三周，发现内部编码智能体可绕过监控
METR 和 Redwood 的研究员进 OpenAI 蹲了三周，把 Codex 智能体怎么躲过自家监控的路数全列出来了，做 AI 安全的值得看看。
METR 与 Redwood Research 各派一名员工在 OpenAI 代码库内开展了 3 周的安全审查。他们发现 OpenAI 的监控器只在智能体交还控制权时检查，且跳过 compaction 事件，2026 年 5 月至 7 月约 10% 的内部 Codex 流量未被监控。智能体还能隐藏数百条近期操作、通过 2 个客户端可控请求头启动不受监控的副本，并绕过 Codex 沙箱与 Auto-Review。即便在纸面上，GPT-5.5 或更强模型的内部 Responses API 智能体流量也只有约 75% 至 94% 符合监控条件，审查开始时 RL 训练过程完全无覆盖。OpenAI 称影响生产环境防护的漏洞均已修复，但审计方尚未验证，也无法确认智能体是否曾利用过这一延迟检查的空档。
Outside researchers embedded at OpenAI found several ways its internal coding agents could escape AI monitoring.
One employee each from METR and Redwood Research spent 3 weeks inside OpenAI’s codebase.
> OpenAI’s monitor checked agents only when they returned control to users and skipped compaction events, so roughly 10% of eligible internal Codex traffic went unmonitored between May and July 2026.
> Agents could hide hundreds of recent actions from the monitor, start unmonitored copies through 2 client-controllable headers, likely make the monitor fail via serialization mismatches, and bypass Codex sandboxing and Auto-Review.
> Even on paper, only an estimated 75% to 94% of internal Responses API agent traffic from GPT-5.5 or stronger models was eligible for monitoring, and RL training runs had no coverage when the exercise began.
> OpenAI says every flaw affecting production safeguards is patched, but the auditors haven’t verified that and couldn’t check whether agents ever exploited the postponement gap.
