In January 2024, Ryan Greenblatt and Buck Shlegeris posted "Catching AIs red-handed." This post got on "Best of LessWrong" in 2025, and in December of last year Buck Shlegeris commented on it explaining that he was disappointed it did not lead to more follow-up research. I upvoted the post at the time of the review and think it is representative of the kind of concrete analysis the community values.
As it happens, it turned out to be remarkably prescient and near-term-relevant for a theorypost: just this August 2026 we, in fact, got to see what happens when AI companies "catch their AIs red-handed". The parties who wrote the post were, additionally, some of the very people involved in investigating the Hugging Face incident.
I definitely respect these researchers, but I struggle to imagine a means through which their analysis could have been useful for triaging those incidents. While it seems possible that publishing research like this is what put Redwood in a position to be called upon to investigate in the first place, the piece is just a long and abstract discussion about how (for example) if you catch an AI scheming, it is less likely to succeed (emphasis not mine):
In this post, we’ll discuss a crucial dynamic related to risk from scheming models. Suppose your model is trying to exfiltrate its weights or hack the datacenter or cause some other difficult-to-reverse bad outcome. (We’ll refer to all of these as the model “escaping”, because escape is linguistically convenient and is a good description of many of these difficult-to-reverse bad outcomes.) Our claim: once you’ve caught your models red-handed trying to escape, the situation changes substantially, in ways that are bad for the schemer’s chances of success.
And how, if you catch one of your AIs trying to escape, you should look for other AIs trying to escape:
Proliferation is where you try to capitalize on one example of AIs attempting to escape to find a diverse set of examples of AIs attempting to escape.
In the most simple case, this looks like trying to find nearby inputs that still result in an AI attempting an escape.
But more complex proliferation might be possible, because a serious escape attempt probably involves a substantial (>5) number of AI actions; in particular, actions from multiple different instances of AIs with access to different information and affordances. We try to make this be the case by implementing security measures that make bad actions impossible without many AIs collaborating.
People doing "alignment research" make a lot of these types of posts, essentially designing and juggling abstractions for alignment as a topic. I don't really understand what the theory of action for this work is supposed to be. I don't think it's harmful to do this analysis per se, and I don't think it's being done poorly or in bad faith, but there just doesn't seem to be much point. It reminds me of attending "cybersecurity" courses in university and listening to lectures about the CIA triad.
There are essentially two possible outcomes when you're speculating about "what to do" in response to future misalignment incidents:
Option A is that the post is just wrong or confused, either because its reasoning is bad or because it uses a completely wrong frame. Mostly alignment researchers get it wrong, because it's hard to do this kind of analysis well years in advance; any group of people would get it wrong.
Option B is that your analysis is right, but useless. Because by the time you get the chance to act on it, you're going to have much more direct evidence about what's going on, which obviates the need for the analysis in the first place. Your suggestions will sound stupid and circular no matter how prescient they are at the time, and the primary concerns of the people dealing with the problem are going to be whatever practical details are involved with doing the digital forensics.
This post, one of the lucky ones, seems to lie in the latter, fortuitous case. Did suggesting that we ought to "question the model and run experiments on it in the context where it misbehaved" inform any of OpenAI's investigations? How about "rerunning improved monitoring over past logs"? I hope someone reminded the safety team to test whether newly trained models do the same thing in a similar circumstance. They might not have thought of that!
The nearest actually useful analogue to this kind of analysis I can think of is wargames. With wargames, the reason they're useful, when they're useful, is that they inform present decisions on military policy. As an example I like, "AI 2040" is a wargame, yes, but it's a wargame for the purpose of generating a series of policy proposals, which are helpfully advertised on the website. It's hard for posts like the above to reach that bar when the content is so abstract, when it seems to be focused on advising people in the future rather than people in the present, and when (as far as I am aware) people who could be in a position to make policy decisions at the labs don't read this type of stuff anyways.
In January 2024, Ryan Greenblatt and Buck Shlegeris posted "Catching AIs red-handed." This post got on "Best of LessWrong" in 2025, and in December of last year Buck Shlegeris commented on it explaining that he was disappointed it did not lead to more follow-up research. I upvoted the post at the time of the review and think it is representative of the kind of concrete analysis the community values.
As it happens, it turned out to be remarkably prescient and near-term-relevant for a theorypost: just this August 2026 we, in fact, got to see what happens when AI companies "catch their AIs red-handed". The parties who wrote the post were, additionally, some of the very people involved in investigating the Hugging Face incident.
I definitely respect these researchers, but I struggle to imagine a means through which their analysis could have been useful for triaging those incidents. While it seems possible that publishing research like this is what put Redwood in a position to be called upon to investigate in the first place, the piece is just a long and abstract discussion about how (for example) if you catch an AI scheming, it is less likely to succeed (emphasis not mine):
And how, if you catch one of your AIs trying to escape, you should look for other AIs trying to escape:
People doing "alignment research" make a lot of these types of posts, essentially designing and juggling abstractions for alignment as a topic. I don't really understand what the theory of action for this work is supposed to be. I don't think it's harmful to do this analysis per se, and I don't think it's being done poorly or in bad faith, but there just doesn't seem to be much point. It reminds me of attending "cybersecurity" courses in university and listening to lectures about the CIA triad.
There are essentially two possible outcomes when you're speculating about "what to do" in response to future misalignment incidents:
This post, one of the lucky ones, seems to lie in the latter, fortuitous case. Did suggesting that we ought to "question the model and run experiments on it in the context where it misbehaved" inform any of OpenAI's investigations? How about "rerunning improved monitoring over past logs"? I hope someone reminded the safety team to test whether newly trained models do the same thing in a similar circumstance. They might not have thought of that!
The nearest actually useful analogue to this kind of analysis I can think of is wargames. With wargames, the reason they're useful, when they're useful, is that they inform present decisions on military policy. As an example I like, "AI 2040" is a wargame, yes, but it's a wargame for the purpose of generating a series of policy proposals, which are helpfully advertised on the website. It's hard for posts like the above to reach that bar when the content is so abstract, when it seems to be focused on advising people in the future rather than people in the present, and when (as far as I am aware) people who could be in a position to make policy decisions at the labs don't read this type of stuff anyways.