Chris Harig

Introduction Traditionally, monitors in AI Control systems are focused on catching threats that involve attackers taking 'bad actions' during seemingly benign tasks, such as exfiltrating sensitive data without permission. Notably, monitors are not currently well suited for catching attackers omitting steps that cause bad outcomes. There is some evidence that...

TL;DR: I built a control setting for computer-use agents and studied a few monitoring setups. I found that attackers can leverage the opacity of computer-use tool calls and gaps between screenshot-action pairs to access credentials or exfiltrate data to other devices on a network without being caught by a monitor....