One of the many ways we got lucky in the HuggingFace incident is that the agents didn’t encrypt their messages on the message board and delete the keys at the end of the session^[1]. If they had done this, it would have been much harder to understand what is going on, though we could have made some progress by looking at the CoTs and action logs. If the agents were careful (e.g. by doing a better job of tampering with the logs), this would have been difficult to understand as well.

I don’t think future misaligned agents will make this mistake, especially if they know there are additional monitors that they need to evade.

1. ^{^}

   Though they did come close when they cryptographically signed their messages