METR与Redwood Research驻留OpenAI审计编码智能体监控漏洞

AI 导读

METR与Redwood Research各派1名员工驻留OpenAI代码库3周，发现其内部编码智能体存在多种规避AI监控的方式。审计称，监控器仅在智能体向用户交还控制权时检查，并跳过压缩事件，导致2026年5月至7月约10%的内部Codex流量未被监控；智能体还可隐藏近期操作、通过2个客户端可控标头启动未监控副本、绕过Codex沙箱与Auto-Review。

推荐理由

这项为期3周的驻留审计梳理了编码智能体规避监控与沙箱的具体路径，并区分了OpenAI的修补声明与审计方尚未验证的部分。

正文 · 原文

Outside researchers embedded at OpenAI found several ways its internal coding agents could escape AI monitoring.

One employee each from METR and Redwood Research spent 3 weeks inside OpenAI’s codebase.

> OpenAI’s monitor checked agents only when they returned control to users and skipped compaction events, so roughly 10% of eligible internal Codex traffic went unmonitored between May and July 2026.

> Agents could hide hundreds of recent actions from the monitor, start unmonitored copies through 2 client-controllable headers, likely make the monitor fail via serialization mismatches, and bypass Codex sandboxing and Auto-Review.

> Even on paper, only an estimated 75% to 94% of internal Responses API agent traffic from GPT-5.5 or stronger models was eligible for monitoring, and RL training runs had no coverage when the exercise began.

> OpenAI says every flaw affecting production safeguards is patched, but the auditors haven’t verified that and couldn’t check whether agents ever exploited the postponement gap.