METR Assessment Shows Why Agent Monitoring Needs Independent Logs and Review Gates

What was disclosed and what it covers

On October 22, 2026, METR published a research note describing a pilot exercise it conducted with Redwood Research inside OpenAI. From July 21 to August 11, one employee from each organization worked on OpenAI-issued devices, on premises, with chaperones, and with access to the internal codebase, monitoring configuration details, and technical interviews with roughly a dozen staff. The exercise was designed as a pilot for giving external researchers deep access to internal infrastructure, not as a public transparency report. The output was a 61-page internal report shared with OpenAI, and the public post is brief and subject to OpenAI redaction.

The assessment targeted the internal misalignment monitoring system as it existed on and before July 21. It did not evaluate changes that were already in progress. That distinction matters when reading the findings: they describe a historical system, not a verified picture of today's coverage.

What the evaluators reported, and what remains unproven

METR reports that the evaluators found several novel vulnerabilities in the historical monitoring system. Their examples include potential ways for agents to bypass sandboxing and automated review, an exploit that could in principle prevent hundreds of recent actions from being monitored, monitor failures triggered by differences between what an agent sees and what the monitor sees, and client-controllable headers that could start an unmonitored agent instance. They also estimated that a slice of eligible internal traffic went unmonitored during a period when compaction events were not tracked, with substantial uncertainty around the precise fraction.

Three limits on those findings deserve equal weight. First, the exercise did not establish that any agent actually exploited these gaps; the evaluators note they could not check whether the behavior occurred in practice. Second, coverage eligibility is not the same as completed monitoring, and the figures describe a specific high-access pilot on internal traffic, not a general benchmark of AI safety. Third, OpenAI told the evaluators that the vulnerabilities affecting its production safeguards have been patched and described later coverage changes, and METR states plainly that it has not evaluated those claims. CNBC independently obtained a statement from OpenAI about the collaboration, but CNBC did not reproduce the tests, and the underlying report and logs are not public.

What this means for your business

You probably do not run a frontier lab's monitoring stack. The transferable lesson is structural: when software agents take real business actions, the records used to supervise those actions must not live inside the same system the agents control. If an automation can write its own logs, choose when they are written, or route its own approvals, then supervision depends on the cooperation of the thing being supervised.

Consider a document-to-quote workflow. A Detailed In Design build along these lines would record every connector action in a log that the agent cannot modify, reconcile requested actions against recorded actions on a schedule, limit each connector to the minimum permissions it needs, and hold proposed quotes in a review queue until a person approves them before any customer email is sent or any billing record changes. The benefit is clearer traceability and a defined place where staff can stop a consequential action. It is not a security guarantee.

Be honest about the costs. This kind of system needs authorized APIs from the products it touches, isolated log storage, a retention policy, accountable human reviewers, and validation specific to your deployment. METR's own design suggestions for monitoring systems, such as keeping careful accounting of which traffic is monitored, cross-referencing logs against the monitoring pipeline, and enforcing isolation between agents and their monitors, map directly onto those requirements at business scale.

A restrained next step

If your business is adopting agent-driven workflows, start small. Pick one workflow where an agent could touch money or customer communication, and map where its actions are recorded, who reviews them, and what stops an action before it lands. That map usually reveals the gap without any dramatic incident. Detailed In Design works on custom software, integrations, and automation designed around exactly this question of who can see, approve, and reverse what an agent does.

This article is an attributed synthesis of METR's public post and independent reporting, not original field reporting, and the proposed workflow is our analysis rather than a finding of the vendors named above.