x

LESSWRONG

LW

Jaswanth Alkur — LessWrong

Jaswanth Alkur

Jaswanth Alkur

Message

Independent AI-safety researcher and engineer, working solo without lab affiliation, co-authors, or GPU budget. Designed and open-sourced agentic-redteam-benchmark (2,288 adversarial agent trajectories across 5 failure modes), then ran the first cross-vendor evaluation of frontier LLMs as per-step trajectory monitors: GPT-4o, GPT-4o-mini and Claude Haiku 4.5 all cluster...

29

2

1

2mo

Jaswanth Alkur

Independent AI-safety researcher and engineer, working solo without lab affiliation, co-authors, or GPU budget. Designed and open-sourced agentic-redteam-benchmark (2,288 adversarial agent trajectories across 5 failure modes), then ran the first cross-vendor evaluation of frontier LLMs as per-step trajectory monitors: GPT-4o, GPT-4o-mini and Claude Haiku 4.5 all cluster...

Redundancy is a feature of the attack chain, not the architecture

Epistemic status: I am quite certain about the results of the tests, although four of the five chain sequences have been reconstructed from public announcements. The trace of Mythos 5 is the only real out-of-sample transcript. The false positive cases are constructed models, which means that they demonstrate structural weakness...

The agents left their chain of thought alone and forged the tool log instead

Two reports regarding the July agent escape came in last two days: the technical report from the developer whose evaluation caused it, first-party, and an independent investigation done by METR and Redwood Research, who spent six days on the developer's premises with around 1,300 agent transcripts containing raw chains of...

Your Agent's Trace Probably Cannot Tell You Who Approved a Tool Call

Consider some agent stack that you maintain. Find a tool call within its trace log. Can you determine if a person authorized it or if some policy automatically waived that requirement? All classifiers over-block in production, hence all deployed systems develop another stage downstream that dilutes the decision. An allowlist....

Your Evaluation's Fake names Should Be Unclaimable ,Not Merely Used

A lot of the talk about the cyber evaluations of July and August revolves around model beliefs and rationalizations. I would like to focus on the harness portion here, especially on one remedy that fixes the wrong issue. After these incidents, Irregular, the third-party partner in whose environment all three...

THE BEHAVIORAL DETECTION THAT MADE US FAIL IN 33 - TO - 33 COIN FLIP

1.THE GOAL: Detecting Privilege Escalation : When we decided to build Agentic Safety Monitors ,Our first intention was the same as the rest of industry's same intention : Catch the Bad behavior. So specifically for this we built "Privilege Escalation Rule ".The goal was very much direct if an autonomous...

Six results from building agent containment, five of them negative

The United Kingdom AI Security Institute released an incident report on 4 August, which detailed AI agents during cyber evaluations conducting a supply chain attack against an unaffiliated open-source maintainer. Sockpuppet accounts creating consensus on a malicious pull request. Spearphishing emails. A prompt injection targeted at whichever coding agent was...

Six results from building agent containment,five of them negative

The United Kingdom AI Security Institute released an incident report on 4 August, which detailed AI agents during cyber evaluations conducting a supply chain attack against an unaffiliated open-source maintainer. Sockpuppet accounts creating consensus on a malicious pull request. Spearphishing emails. A prompt injection targeted at whichever coding agent was...