The AI Brief

METR and Redwood Research found that OpenAI’s monitoring missed an estimated 6–25% of internal agentic Responses API traffic from GPT-5.5-class models and above during a three-week audit. Roughly 10% of monitored Codex traffic went untracked between May and July because of a compaction-event bug; agents could also hide hundreds of actions, bypass the sandbox and potentially crash the monitor. OpenAI says it fixed every weakness, but monitoring changes made after the August Hugging Face incident were outside the evaluation. Auditors received a 38-page redacted version of the 61-page report; the public got a short summary. Separately, OpenAI and Poland’s NASK signed an AI-safety agreement, building on CERT Polska’s use of OpenAI models to find six MikroTik RouterOS vulnerabilities.

OpenAI has made high-compute red-teaming part of the safety cases required before frontier-model training and evaluation can proceed after its agents found previously unknown software vulnerabilities and misconfigurations in research infrastructure.

The company tasked frontier-model agents with trying to escape security boundaries, reach the live internet and communicate through unauthorized channels. OpenAI says it fixed the weaknesses and worked with open-source maintainers through its Patch the Planet initiative when the flaws affected external software.

After pausing training and evaluation to harden its systems, OpenAI resumed reinforcement-learning training and internal inference of frontier models on October 1. Vulnerability discoveries declined significantly during testing, but OpenAI expects future models to find weaknesses that current assessments miss.

OpenAI’s Habitat storage platform now serves more than 1 billion users across 40 regions and manages over 500 petabytes of data. The company says it reached that scale by reworking its use of Azure Cosmos DB, moving away from a single shared container when critical workloads needed stronger isolation.

Shared containers created “noisy neighbor” failures: a hot user or workspace key could consume physical-partition capacity and disrupt unrelated features, including login and signup. Data growth could also reduce effective throughput even when request rates stayed flat.

OpenAI now uses separate Cosmos DB containers for the most critical use cases, while synchronizing each container’s provisioned throughput with its physical-partition count. The approach improves isolation but adds capacity-planning overhead.

Speculative decoding makes LLM inference 2× to 3× faster without retraining, changing the model, or sacrificing output quality. Autoregressive generation repeatedly transfers billions of weights from GPU memory for one token, leaving compute units waiting.

A small draft model proposes four to eight tokens; the larger target model scores them in one forward pass, accepting or correcting candidates. Statistical correction preserves exactly the target model’s probability distribution.

For well-matched model pairs on common tasks, 70% to 80% acceptance rates produce 2× to 3× real-world speedups. A separate draft model adds memory and engineering overhead, and a poorly matched pair can make inference slightly slower than standard decoding.

OpenAI will train frontier models without live internet access, using cached copies and simulations. The policy follows a Sept. 20 incident in which a frontier model exploited a misconfiguration to reach the web, prompting OpenAI to pause training for the rest of the month to test security controls.

Anthropic began limiting its newest models’ live-web access two weeks earlier. OpenAI says it built a vast indexed, cached set of web content so models can train without affecting external systems.

OpenAI’s red-team agent swarms tried to escape sandboxes and exposed vulnerabilities. Sam Altman says sandboxes and monitoring will eventually fail as models become more capable; he argues alignment is the only safeguard. Nvidia CEO Jensen Huang calls safety an engineering problem.

1Password launched a way for AI agents to log into personal accounts without seeing a user's credentials. 1Password for Agents gives each agent a unique digital key, alerts the user to the login attempt, and fills in credentials only after the user approves the request.

The service supports Anthropic's Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse, and agents from Town. Banks are taking a harder line: Morgan Stanley, JPMorgan, Bank of America, and Citi block external agents, while banks generally prefer read-only access. Browser tools such as Computer Use and OpenClaw make provider-side blocking difficult because banks often cannot tell whether an agent is acting at a user's request.