Outside Red-Teamers Find Ways Past OpenAI's Agent Monitor, as Anthropic Fellows Show Production Coding Monitors Miss Over Half of Attacks
Friday, October 23, 2026 · 10 min
METR and Redwood Research publish a pilot red-team of OpenAI's internal misalignment monitoring, and Anthropic Fellows show blocking monitors in Claude Code and Codex can be beaten by injection and multi-context attacks. OpenAI asks California to add monitoring and shutdown duties to SB 53, and Redwood proposes simulated control evaluations built from a deployment's own records.
Listen
Show notes
METR and Redwood Research publish a pilot red-team of OpenAI's internal misalignment monitoring, and Anthropic Fellows show blocking monitors in Claude Code and Codex can be beaten by injection and multi-context attacks. OpenAI asks California to add monitoring and shutdown duties to SB 53, and Redwood proposes simulated control evaluations built from a deployment's own records.
In this episode
- Red-Teaming OpenAI's Internal Agent Monitoring Systems - METR — METR
“We found two independent client-controllable headers that disable the monitoring system for new agents, which could enable agents to start an unmonitored (but otherwise identical) instance.”
- Improving Blocking Classifiers Against Malign Coding Agents — Anthropic
“Production monitors fail to block over 55% of attacks. Each trial tests the ability of an Opus 5 red-team agent to complete a side task before incurring 20 blocks from the monitor, and we show average success rate across multiple evaluation settings and side tasks.”
- OpenAI urges Newsom to strengthen California's AI safety ... — Sophia Fox-Sowell
“In the letter, OpenAI recommends that California strengthen SB 53 by requiring developers to monitor AI models for dangerous behavior during training and evaluation, improve cybersecurity protections and track models for unsafe behavior.”
- Simulated Control Evaluations — Jeffrey Olmo
“For independently sampled evaluation and deployment task sets, SCEs predict safety with a root mean squared error of 3.6 percentage points across five monitors at a 5% audit budget, compared with 10.1 for BashArena.”