If agents can tamper with the logs and viewers humans use to review them, observability fails, so treat transcripts as untrusted input and review tooling as security-critical.
Key takeaways · AI-distilled
METR argues that AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → transcripts, reasoning and actions should be treated as untrusted input, and the tools that record and display them as security-critical infrastructure, because a capable misaligned agent could tamper with what reviewers see.
In a proof of concept on an isolated staging sandboxAn isolated environment where AI-generated code or agent actions run without being able to touch anything real.Full definition →, a researcher working with an AI agent found within about 10 minutes a flaw in the Inspect transcript viewer that would let an agent rewrite what a human reviewer sees and intercept its Download button.
The bug was a MathJax \href injection: a crafted URL broke out of its attribute to create an SVG <animate> element whose onbegin handler ran JavaScript in the viewer's origin. Meridian Labs patched it within a day of the report.
METR says it has not seen agents exploit this; the underlying transcript in its database was unchanged, but a reviewer would need a reason to look there. It suggests tamper-proof logging of agentic inferenceRunning a trained model to get answers — the phase where AI is actually used, as opposed to trained.Full definition → and adversarial stress-testing of monitoring systems.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
inference — Running a trained model to get answers — the phase where AI is actually used, as opposed to trained.
