Intel / article

How an assessor could investigate control and monitoring of internal AI agents

Source: metr.org
Date: Published Oct 14, 2026

Context

A monitor's accuracy matters only for the actions it actually sees. METR's control-assessment proposal would examine the whole path from an taking an action to someone stopping harmful behavior: whether monitoring covers it, whether the monitoring infrastructure remains intact, and whether a warning gets an effective response.

That requires evidence beyond a model . Assessors would compare and monitoring logs, inspect the relevant code, review incidents and interview staff about how the systems operate. A monitor could classify the examples it receives correctly while still missing an unmonitored source of activity. The proposal describes how to investigate that gap; it does not certify a particular developer's controls.

Key takeaways · AI-distilled

METR proposes that an outside assessor test AI developers' agent monitoring along five questions: coverage of internal agentic inference, vulnerabilities in the monitoring system itself, monitor evasion, human review and response, and the worst harm an agent could do undetected.
On coverage, METR says assessors should verify that unmonitored inference is actually non-agentic rather than assume it, because a misaligned agent that compromised infrastructure could route actions through unmonitored paths.
For evasion testing, METR asks for at least ~100k representative internal agent transcripts and ~100 of the most severe incidents, both to find misbehavior monitors missed and to spot attack opportunities agents passed up.
METR flags monitor-agent collusion as a growing concern and suggests honeypots for monitors and searching monitors' chains of thought for discussion of collusion.
The access requested is broad: codebase access comparable to the developer's own security researchers, inference and monitor logs to cross-reference, and the ability to insert realistic attack trajectories to see whether human reviewers escalate them.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
benchmark — A standard public test set for comparing AI models — the shared scoreboards behind every "model X beats model Y" claim.
inference — Running a trained model to get answers — the phase where AI is actually used, as opposed to trained.

Read the source metr.org