Lessons From Red-teaming Auto-review, OpenAI's Blocking Monitor

Abstract

This work and the report were done by Giovanni Occhipinti, as part of the ERA fellowship and mentored by Monika Jotautaitė (Apollo Research). Summary We red-teamed synchronous control measures in Codex, with a focus on its blocking monitor Auto-review . Our campaign directly analyzed the Codex codebase, searching for exploits that are enabled by the scaffold itself, both against the models used as monitors and other measures such as the Codex sandbox, protections, and deny rules. We found 11 attacks that a misaligned agent could use to defeat the Codex sandbox and Auto-review, executing arbitrary malicious code. Our taxonomy groups the attacks into three vectors: (1) misconfigurations that create coverage gaps in which actions are controlled, such as writes to sensitive targets; (2) fooling the monitor through injections, truncated evidence, or deceptive framing; (3) hybrid attacks that combine the first two vectors, often relying on timing exploits, where actions get approved based on stale content that can be modified before execution. We shared our results and recommendations with OpenAI, who fixed several of the vulnerabilities we found. We believe that these recommendations ca

Research area