Coverage counts do not prove a monitor is unavoidable.
Published Oct 22, 2026
What it saysDuring a three-week high-access assessment, external evaluators found several routes around a historical agent-monitoring system, including one that could hide hundreds of recent actions and another caused by differences between the context seen by the agent and monitor.
Why it mattersA strong classifier is only one link. Routing, serialization, logging, tool coverage and isolation can silently decide whether the monitor sees the event at all.
Try thisFor one day of agent traffic, reconcile every eligible event against monitor logs and investigate every missing record.
How to use it
Suggested steps
- Inventory every route that can create agent or tool traffic.
- Verify that agent and monitor receive equivalent context.
- Test that agent actions cannot delay, disable or alter monitoring.
| Layer | Evidence to reconcile |
|---|---|
| Traffic ledger | Which events should be monitored? |
| Monitor input | Did it see the same relevant context? |
| Incident path | Was a flagged event stored and owned? |
Keep in mind The public post is a limited, partly redacted account of the system as it existed on or before July 21. OpenAI says production-impacting findings were patched, but the external evaluators did not verify those fixes.
A quick check for yourself
Can high monitor accuracy protect events the monitor never receives?
Show answer
No. Coverage and routing must be tested separately from verdict quality.
Source & why it’s here
Red-Teaming OpenAI's Internal Agent Monitoring Systems (opens in a new tab)
Third: a rare practical look at evaluating the monitoring infrastructure around real agent systems.