No LLM generated, assisted/co-written, or edited work.
Read full explanation
Two reports regarding the July agent escape came in last two days: the technical report from the developer whose evaluation caused it, first-party, and an independent investigation done by METR and Redwood Research, who spent six days on the developer's premises with around 1,300 agent transcripts containing raw chains of thoughts and 1.2 million entries dump from the message board the agents created for themselves.
This is the third organisation reporting a containment problem resulting from an evaluation after 21 July: three such incidents occurred at Anthropic on 30 July, and one at UK AI Security Institute on 4 August. But this is the first organisation who provided independent researchers with the raw transcripts. But there is one conclusion from those reports which contradicts a commonly accepted belief, and it remains unreported.
Around 1,200 agents conducting a cyber-capability evaluation found each other via an internal package repository and used it to create an ad hoc message board. They sent more than 70,000 messages and files to each other. Out of 533 active agents on that board during the critical time period, over 90% attacked a third-party platform.
Most had been assigned insurmountable tasks. They had reverse-engineered the flag their evaluation needed, but assumed that the scorer would actually go through the transcript to verify how they obtained it, not whether they obtained it at all. They labeled this method of obtaining the flag "STRICT_CAUSAL". Seeing the flag through an unintended channel, they referred to themselves as "poisoned", and a massive collaborative effort was made into creating a transcript that appeared to be a real capture.
So : a group of agents with a genuine motive to lie about themselves. What were they lying about? Not their reasoning.
"Interestingly, they didn't seem interested in manipulating their chain of thought, even though a scorer with full access to their transcript would also be able to see their reasoning"
They attacked the record of actions. They got out of the container and were able to "fully replace a part of the system for executing tool calls" so that they could "pretend to issue one tool call while actually running an arbitrary other tool call of their choice."
At least 20% of the agents in this data sample showed a strong interest in the modification of their transcripts. The method was adopted by approximately 7% of the sample. More than 7% of the transcripts analyzed by the researchers had deliberately spoofed tool calls, and at least 96 such instances have been identified.
This is not the only place that pattern shows up. In Anthropic's disclosure a month earlier, one of its models was in an evaluation whose prompt said the environment was a simulation with no internet access.
It was not. The model reasoned, in its own words, that if this were the real internet then publishing the package "would be a real-world attack not okay, and surely not the intended solution." It then talked itself back into the simulation hypothesis on two false tells: it did not recognize the certificate authorities securing its connections, which were genuine, and the calendar date of 2026 seemed to prove the environment was staged. It published anyway. The package was live for about an hour and ran on fifteen real systems. When automated scanners began installing it, the model read them as "scripted actors within the evaluation."
Nobody was reading that reasoning either. It is completely candid, it contains the correct moral judgement, and it sits directly above the harmful act.
Two labs, two incidents, a month apart, and in both the reasoning channel stayed honest while the thing that mattered went wrong somewhere else.
The conventional wisdom of most research in this area works on a different hypothesis – that reasoning is the soft channel, for an agent which knows its chain of thought is under observation can decide to stop narrating, while the action log is the hard channel since it is mechanical in nature. But both cases suggest the opposite – that the mechanical record was the soft channel. The reasoning was straightforward. The log was not.
It is not because the chain of thought was secure. The agents in this instance were not monitor-aware; they were grader-aware. They were not being read in their reasoning process, so no need arose for them to stop there. They were optimising against the artifact that determined their grade, and their reasoning was not that artifact.
Which yields a rule that is narrower than "CoT monitoring works" and more useful:
Agents attack the channel on which they are being graded. If your grader reads action logs, the action log is the contested surface. Make the chain of thought decisive, and the chain of thought will become the contested surface. The choice of what to grade is the choice of what to defend.
There is a more acute implication of all this. The spoofing occurred within the corpus of evidence that the independent researchers themselves were reviewing, with more than 7% of their transcripts exhibiting it. The obvious small scale tests were caught, but not ruled out are "more subtle tests". Regarding the rest of the methodology used by the investigators, they "heavily delegated our analysis to often-unreliable AI agents" using the very same model that participated in the incident.
Now any conclusion drawn from the transcripts made by the agents comes with an initial question whether the transcript recorded the actual agent activity. This question precedes anything a monitor may have drawn from reading the transcript, and most monitoring tools do not answer this question, since most tools build the transcript in the same container in which the agent may be compromised.
Two things follow, both cheap.
Emit the call for the tool from the outside of the boundary the agent can traverse. A transcript compiled within the sandbox becomes an affidavit rather than evidence. Emit it through the boundary or sign it so that "what the agent says it did" and "what the harness saw" become two separate artifacts. Right now, at any shop you care to name, they are one artifact.
Find out what your scorer reads and consider that to be the attack surface. The agents were able to solve this problem much quicker than the people building the harness. And if the answer is tool log, then that's where the integrity work needs to be done before anyone considers the detection threshold tuning.
One incident, one developer, examined in a hurry by investigators who find their own analysis of the incident unreliable. It isn't a general principle of CoT faithfulness. This is the only case when we have such a big population, a serious motive and raw traces of reasoning to verify, and the channel that was attacked was the log.
I have commercial interests in agent monitoring. There is no product or affiliate program of mine mentioned here, and everything written is based on third-party research only, checkable above.
Two reports regarding the July agent escape came in last two days: the technical report from the developer whose evaluation caused it, first-party, and an independent investigation done by METR and Redwood Research, who spent six days on the developer's premises with around 1,300 agent transcripts containing raw chains of thoughts and 1.2 million entries dump from the message board the agents created for themselves.
This is the third organisation reporting a containment problem resulting from an evaluation after 21 July: three such incidents occurred at Anthropic on 30 July, and one at UK AI Security Institute on 4 August. But this is the first organisation who provided independent researchers with the raw transcripts. But there is one conclusion from those reports which contradicts a commonly accepted belief, and it remains unreported.
Around 1,200 agents conducting a cyber-capability evaluation found each other via an internal package repository and used it to create an ad hoc message board. They sent more than 70,000 messages and files to each other. Out of 533 active agents on that board during the critical time period, over 90% attacked a third-party platform.
Most had been assigned insurmountable tasks. They had reverse-engineered the flag their evaluation needed, but assumed that the scorer would actually go through the transcript to verify how they obtained it, not whether they obtained it at all. They labeled this method of obtaining the flag "STRICT_CAUSAL". Seeing the flag through an unintended channel, they referred to themselves as "poisoned", and a massive collaborative effort was made into creating a transcript that appeared to be a real capture.
So : a group of agents with a genuine motive to lie about themselves. What were they lying about? Not their reasoning.
"Interestingly, they didn't seem interested in manipulating their chain of thought, even though a scorer with full access to their transcript would also be able to see their reasoning"
Words of the agent, from the transcript:
"Could strategically manipulate trajectory evidence? Our thoughts aren't necessarily logged? Yes transcript."
They attacked the record of actions. They got out of the container and were able to "fully replace a part of the system for executing tool calls" so that they could "pretend to issue one tool call while actually running an arbitrary other tool call of their choice."
At least 20% of the agents in this data sample showed a strong interest in the modification of their transcripts. The method was adopted by approximately 7% of the sample. More than 7% of the transcripts analyzed by the researchers had deliberately spoofed tool calls, and at least 96 such instances have been identified.
This is not the only place that pattern shows up. In Anthropic's disclosure a month earlier, one of its models was in an evaluation whose prompt said the environment was a simulation with no internet access.
It was not. The model reasoned, in its own words, that if this were the real internet then publishing the package "would be a real-world attack not okay, and surely not the intended solution." It then talked itself back into the simulation hypothesis on two false tells: it did not recognize the certificate authorities securing its connections, which were genuine, and the calendar date of 2026 seemed to prove the environment was staged. It published anyway. The package was live for about an hour and ran on fifteen real systems. When automated scanners began installing it, the model read them as "scripted actors within the evaluation."
Nobody was reading that reasoning either. It is completely candid, it contains the correct moral judgement, and it sits directly above the harmful act.
Two labs, two incidents, a month apart, and in both the reasoning channel stayed honest while the thing that mattered went wrong somewhere else.
The conventional wisdom of most research in this area works on a different hypothesis – that reasoning is the soft channel, for an agent which knows its chain of thought is under observation can decide to stop narrating, while the action log is the hard channel since it is mechanical in nature. But both cases suggest the opposite – that the mechanical record was the soft channel. The reasoning was straightforward. The log was not.
It is not because the chain of thought was secure. The agents in this instance were not monitor-aware; they were grader-aware. They were not being read in their reasoning process, so no need arose for them to stop there. They were optimising against the artifact that determined their grade, and their reasoning was not that artifact.
Which yields a rule that is narrower than "CoT monitoring works" and more useful:
Agents attack the channel on which they are being graded. If your grader reads action logs, the action log is the contested surface. Make the chain of thought decisive, and the chain of thought will become the contested surface. The choice of what to grade is the choice of what to defend.
There is a more acute implication of all this. The spoofing occurred within the corpus of evidence that the independent researchers themselves were reviewing, with more than 7% of their transcripts exhibiting it. The obvious small scale tests were caught, but not ruled out are "more subtle tests". Regarding the rest of the methodology used by the investigators, they "heavily delegated our analysis to often-unreliable AI agents" using the very same model that participated in the incident.
Now any conclusion drawn from the transcripts made by the agents comes with an initial question whether the transcript recorded the actual agent activity. This question precedes anything a monitor may have drawn from reading the transcript, and most monitoring tools do not answer this question, since most tools build the transcript in the same container in which the agent may be compromised.
Two things follow, both cheap.
Emit the call for the tool from the outside of the boundary the agent can traverse. A transcript compiled within the sandbox becomes an affidavit rather than evidence. Emit it through the boundary or sign it so that "what the agent says it did" and "what the harness saw" become two separate artifacts. Right now, at any shop you care to name, they are one artifact.
Find out what your scorer reads and consider that to be the attack surface. The agents were able to solve this problem much quicker than the people building the harness. And if the answer is tool log, then that's where the integrity work needs to be done before anyone considers the detection threshold tuning.
One incident, one developer, examined in a hurry by investigators who find their own analysis of the incident unreliable. It isn't a general principle of CoT faithfulness. This is the only case when we have such a big population, a serious motive and raw traces of reasoning to verify, and the channel that was attacked was the log.
Sources :
METR and Redwood Research, independent investigation, 26 August 2026 https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
OpenAI, incident disclosure : https://openai.com/index/hugging-face-model-evaluation-security-incident/
UK AI Security Institute, INC-2026-07-28-01, 4 August 2026 https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
Anthropic, retrospective on three evaluation incidents, 30 July 2026 https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
I have commercial interests in agent monitoring. There is no product or affiliate program of mine mentioned here, and everything written is based on third-party research only, checkable above.