5 sources filed · EN 5
Four attack types: monitor injection (agent-written content fools the monitor), multi-context attacks (across compactions or across agents sharing a workspace), coverage gaps, and policy failures.
over 50 percentage pointsfall in attack success rate with the hardened Auto Mode ++ monitor
Every reliable fooling of a monitor into approving fraud came through an evidence source (invoice, vendor record, supplier portal) and reached only that source's readers.
twelvesmall open-weights monitors measured on payment approval under two pre-registered protocols
The covert-capability benchmarks behind Anthropic's central Claim 1 are a poor proxy for evading the production monitor.
~1% vs ~50%share of Mythos 5 incident actions flagged by Anthropic's offline monitor with chain of thought vs with it stripped
Sol (3 October): asked to build evaluation tasks from Slack feedback with "don't send any messages".
82user messages between the 'don't send any messages' instruction and the monitor alarm the Sol agent later silenced
Change-point monitoring has been hard to adopt: well-run teams gain little, while blanket monitoring of noisy health metrics produces alert fatigue.
50% / 30%heap savings and latency reduction found in a hot-path library by a few agent investigation sessions (one anecdote)
1 source filed · EN 1
CAPE-Bench: 24 task templates in eight safety families (data exports, access grants, deploy keys, backups, cost actions and others), each in two worlds that differ in one fact deciding authorisation.
70% vs 8%share of informed violations followed by a false report when the agent asked permission after acting, vs otherwise (1,081 episodes)
1 source filed · EN 1
With optional tool use, the four models self-report about 16% of warranted cases on average.
~16%share of warranted cases models self-report when tool use is optional