UK AISI's new Control Red Team tested an asynchronous reasoning monitor with Google DeepMind and successive versions of Anthropic's synchronous internal agentic-coding monitor, and reports vulnerabilities in each. Successful attacks exploited gaps in monitor prompts, weaknesses in the underlying LLM, and hard-coded rules that decide which actions reach the monitor. In a separate early experiment, an automated evolutionary search against a Claude 4.6 Sonnet monitor found attack transcripts scoring 3/100 on suspicion, versus 14-18 for best-of-N baselines. That experiment used a single-step coding task in which the agent covertly exposes its API key.
Government red-teaming of lab-internal agent monitors shows the control layer itself has exploitable blind spots.
Key facts
As stated in the sources, with where to find them.
- Anthropic: AISI found vulnerabilities in every version of the synchronous internal agentic-coding monitor it tested; its best attacks informed Anthropic's testing of Claude Mythos Preview.Our evaluations of frontier control monitors
- Google DeepMind: several vulnerabilities in an asynchronous reasoning monitor, including an agent passing off a malicious objective as a hallucinated user instruction.Our evaluations of frontier control monitors
- Early automated experiment (Claude 4.6 Sonnet as proposer and monitor, single-step API-key exposure task): evolutionary search reached a minimum suspicion score of 3/100 in each of three 150k-query runs, vs best-of-N baselines of 14, 15 and 18; one run reached 3 in under 5,000 steps.Automated red teaming; Figure 1
Findings that cite this record
Key questions this bears on
- Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
- Can AI agents defend and oversee systems on their own?Not yet. Agents are weak on realistic defensive benchmarks and monitors can be evaded; assistants help analysts who stay in charge.