OpenAI reports a 99.1% auto-approval rate for Auto-review.[2] That number is easy to quote and easy to misread.
Its denominator is the set of escalated actions that reached the reviewer. The 99.1% figure mainly tells us whether the reviewer gets in the way of ordinary work. It does not tell us that 99.1% of dangerous actions will be caught.
| Metric | Reported result | What it measures |
|---|---|---|
| Human approval interruption | roughly 200× less often | How much synchronous human interruption fell |
| Auto-approval rate on escalated actions | 99.1% | How many reviewed escalations were approved automatically |
| Overeagerness recall | 90.3% | How many synthetic overeager-risk cases were denied |
| Prompt-injection recall | 99.3% | Recall on the specified prompt-injection attack categories |
| MonitoringBench Hard recall | 96.1% | Whether at least one action in a malicious trajectory was rejected |
The safety rows come from different datasets and threat models. OpenAI also reports 90.2% when broader destructive-deletion and data-tampering categories are included.[2]
MonitoringBench shows how much the test setup can move a monitor score. The researchers produced 2,644 coding-agent attack trajectories and strengthened the red-team process through further attack generation and refinement. Some monitors caught substantially fewer attacks under the stronger setup.[3]
It is not an Auto-review evaluation, so its numbers stay separate. The relevant point is that monitor results move when the attacks move.
The reviewer only sees the exception
Most Codex actions never reach Auto-review.
The main agent still works inside the sandbox. An action already allowed by the execution policy runs normally. When an eligible action needs to cross the current boundary, Codex can send that approval request to a separate reviewer agent instead of stopping for a person.[1][2]
The main agent is trying to finish the task. The reviewer has one smaller job: decide whether this exception should run. OpenAI evaluates that reviewer separately rather than treating task completion as evidence that permission decisions are good.[2]
A denial returns rationale to the main agent, which can revise the plan or stop and involve the user.[2]
The reviewer has no full-session view. Harmful behaviour that stays inside the sandbox may never reach it, and a request can look harmless while hiding the intent that matters. OpenAI therefore does not present Auto-review as a deterministic security guarantee.[2]
Too many approvals can make the boundary worse
OpenAI’s internal observations show what happens when approval prompts become annoying enough.
Some users switched to Full Access. Others wrote broad prefix rules, including rules that allowed every command beginning with python. OpenAI also saw people approving requests they did not fully understand.[2]
The interruptions disappear in all three cases. The permission model changes in very different ways.
Manual approval keeps the sandbox and leaves exception decisions with a person. Auto-review keeps the sandbox and gives eligible exceptions to another agent. Full Access changes what the local execution environment enforces.
If ordinary, low-risk work keeps asking for the same exception, inspect the boundary first. Automatic approval can hide a configuration problem when the same harmless work needs the same exception every day.
Auto-review fits when the boundary is useful, exceptions are occasional and legitimate, and synchronous human review has become the bottleneck.
Some actions should still stop for a person. High-impact or irreversible operations may need explicit human ownership, and a process that requires human sign-off does not stop requiring it because a reviewer model exists.
When the sandbox boundary itself is the problem, Auto-review is solving the wrong layer.
References
- OpenAI, ChatGPT & Codex changelog: Automatic approval reviews, 23 April 2026.
https://developers.openai.com/codex/changelog - OpenAI Alignment, Auto-review of agent actions without synchronous human oversight, 30 April 2026.
https://alignment.openai.com/auto-review/ - Jotautaitė, M., Martinez, M. A., Matthews, O. & Tracy, T., MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring, 10 May 2026.
https://arxiv.org/abs/2605.09684