Red-Teaming Anthropic's Internal Agent Monitoring Systems

A monitor can miss an agent's actions for two different reasons: it may never receive them, or it may misjudge what it sees. METR's embedded red-team exercise at Anthropic found weaknesses in both coverage and interpretation. Some identified issues were subsequently fixed, so the findings describe the tested systems at that time.

The report also distinguishes vulnerabilities a knowledgeable human could exploit from attacks the evaluated models could independently devise and carry out. Those models often lacked the necessary situational knowledge and made serious implementation mistakes. That limited their demonstrated threat, but it leaves a dependency worth tracking: protection partly arising from an agent's ignorance may weaken as its knowledge and capabilities improve.