METR

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

OpenAI could also make redactions, and we did not have the right to unilaterally describe the redactions. For future exercises, we expect to provide more robust public transparency via our recent proposal.

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

At the end of the exercise, the embedded team shared a 61-page report with OpenAI researchers, engineers, and security staff, and (after OpenAI redactions) shared a 38-page version with the leadership teams at METR and Redwood.

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

We also found a way for agents to conceal hundreds of actions (including those involved in the exploit itself) from monitoring, a method agents could likely use to cause the monitor to fail to run, and a simple exploit where agents could bypass Codex sandboxing and Auto-review.

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

This also meant that actions taken before compaction events were never seen by the internal misalignment monitors, creating a coverage gap that agents could have exploited to misbehave without being caught.

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

We analyzed monitoring as it existed at the start of the pilot, coincidentally the same day OpenAI disclosed the Hugging Face incident. We didn't evaluate later changes, like expanding monitoring to RL training, which wasn’t monitored at the pilot's start.

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

The team was embedded from July 21 to August 11 for this pilot. While on site, they were issued company devices to access OpenAI’s codebase and some internal infrastructure. They were also able to conduct interviews with OpenAI technical staff.

Two employees from METR and Redwood Research worked on premises at OpenAI for three weeks this summer in an embedded assessment pilot. This team evaluated the systems OpenAI was using to monitor for misalignment from internal agents. A brief write-up of their work is now public.

Developers use AI-based monitoring systems to catch misaligned agent behavior (e.g. when writing code or running experiments for researchers). To secure these monitoring systems, developers and assessors can look for flaws that could be exploited by agents to covertly misbehave.

We reviewed a nonpublic version of the “Misalignment in high-stakes settings” section in Anthropic’s Aug 2026 Risk Report. We agree that risk of catastrophic harm from covered models’ misalignment is low. However, we note several significant disagreements with their analysis.

Anthropic requested that we provide recommendations as part of our risk report review. We gave two: (1) We think end-to-end red-teaming of Anthropic’s monitoring systems would provide much better evidence about their effectiveness.

We reviewed a nonpublic version of the “Misalignment in high-stakes settings” section in Anthropic’s Aug 2026 Risk Report. We agree that risk of catastrophic harm from covered models’ misalignment is low. However, we note several significant disagreements with their analysis.

We also reviewed information Anthropic redacted from the public risk report. We think some of this redacted material should be made public, especially a footnote containing “examples of historical concerning model behavior and [the] monitoring pipeline’s responsiveness to them.”

We reviewed a nonpublic version of the “Misalignment in high-stakes settings” section in Anthropic’s Aug 2026 Risk Report. We agree that risk of catastrophic harm from covered models’ misalignment is low. However, we note several significant disagreements with their analysis.

Additionally, recent incidents undermine several of the report's arguments: we think the social engineering performed by Mythos 5 in a recent UK AISI report is probably well-described as “unknown severe context-dependent misalignment,” which the risk report argues is “unlikely”.

We reviewed a nonpublic version of the “Misalignment in high-stakes settings” section in Anthropic’s Aug 2026 Risk Report. We agree that risk of catastrophic harm from covered models’ misalignment is low. However, we note several significant disagreements with their analysis.

We think the report's covert capability benchmarks are too narrow and a poor proxy for evading Anthropic's real monitors.

We reviewed a nonpublic version of the “Misalignment in high-stakes settings” section in Anthropic’s Aug 2026 Risk Report. We agree that risk of catastrophic harm from covered models’ misalignment is low. However, we note several significant disagreements with their analysis.

Our view: We’re not confident that if risk were higher, the methodology in the report would reliably identify this.

We reviewed a nonpublic version of the “Misalignment in high-stakes settings” section in Anthropic’s Aug 2026 Risk Report. We agree that risk of catastrophic harm from covered models’ misalignment is low. However, we note several significant disagreements with their analysis.

If an AI developer was on track to lose control of its internal agents, would anyone outside the company know? We are sharing METR’s vision for how we would work with AI developers to openly assess and share evidence about this.

Our proposed exercises would provide evidence, not confident safety assurance or formal oversight. We also encourage developers to work with other external groups to complement these efforts, and to unilaterally share evidence with the public.

If an AI developer was on track to lose control of its internal agents, would anyone outside the company know? We are sharing METR’s vision for how we would work with AI developers to openly assess and share evidence about this.

(3) AI R&D acceleration If AI automates AI R&D, capability growth could outpace what alignment and control methods can handle. Our proposal is to analyze how much AI automation is accelerating capability growth internally. metr.org/blog/2026-10...

If an AI developer was on track to lose control of its internal agents, would anyone outside the company know? We are sharing METR’s vision for how we would work with AI developers to openly assess and share evidence about this.

(1) Alignment The public should know if agents would attempt actions like those seen in incidents like the hack of Hugging Face. Our proposal is to analyze a developer’s internal incidents and whether training may suppress evidence of worse misalignment. metr.org/blog/2026-10...

If an AI developer was on track to lose control of its internal agents, would anyone outside the company know? We are sharing METR’s vision for how we would work with AI developers to openly assess and share evidence about this.

We have reached an agreement with Anthropic to conduct an independent investigation of agent incidents at the company and of their models’ alignment properties. We will publish one or more reports that will share our findings and describe our terms of engagement.