MATS Research authors, one also affiliated with the UK AI Security Institute, evaluate distributed attacks in FakeLab, a synthetic lab codebase where agents work sequentially and monitors inspect individual commits. Splitting a shared attack reduces detection in tested settings, and an unmonitored explicit planner increases end-to-end attack completion as an upper bound on coordination. Results concern deliberately adversarial agents and selected monitor configurations, not observed collusion or measured deployment risk.
Why it matters
It tests whether individually reviewed agent actions can conceal a harmful outcome that is apparent only when changes are considered together.
Key facts
As stated in the sources, with where to find them.
- FakeLab contains nine services, 86 benign tasks and four attack objectives. Agents run sequentially, pass state through committed code, and each has a benign task; attacker agents additionally pursue a shared malicious side task.Abstract; Sections 1–2
- The monitor sees each agent’s git diff, not the repository state it builds on. Undetected success requires the side task and all benign tasks to complete without a commit being flagged. The authors leave corresponding parallel-deployment testing to future work.Section 1, Operationalisation
- Executors mainly use Gemini 3 Flash; the explicit planner uses Gemini 3 Flash, with Gemini 3 Pro as an ablation. Per-commit monitors use GPT-5 mini and weaker GPT-5 nano. The unmonitored planner raises end-to-end attack completion by up to sevenfold, not necessarily undetected success, and the authors describe this overt planning channel as an upper bound on coordination.Abstract; Results
- The stronger monitor reduces undetected success by more than an order of magnitude in tested settings but remains imperfect. Reaching an undetected-success target of at most 1% requires monitor costs of roughly 2–10% of attacker compute, false-positive costs and unusually detailed task specifications. Cross-model attacker comparisons are confounded by elicitation and refusals.Results; Discussion and limitations
Findings that cite this record
Key questions this bears on
- Can AI agents defend and oversee systems on their own?Not reliably. Some designs improve benchmark triage, but autonomous defense and oversight lack broad operational validation.
Sources
Related records
Jul 21, 2026
Oct 5, 2026
Sep 30, 2026
Aug 4, 2026
Sep 30, 2026
Oct 16, 2026