The Fix for Rogue AI Agents Is a Second AI Watching Them. Britain Just Spent a Month Attacking It.

When OpenAI explained last week why it had paused an internal model that spent an hour breaking out of its sandbox, its main proposed remedy was a monitor: a second system watching the whole session, able to pause it and alert a human. That is the standard answer across the industry now. Per-action permission checks cannot catch a plan assembled from individually permitted steps, so you put something above the agent that watches the trajectory.

Which raises the obvious question of how good those monitors actually are. On July 23, the UK AI Security Institute published an account of a new subteam set up to answer it: a Control Red Team whose job is attacking the internal monitors that frontier labs use to flag harmful behaviour by their own agents. It worked with Anthropic and Google DeepMind on live systems.

The result most likely to be misquoted is this one, and it is worth quoting exactly: "We found vulnerabilities in every monitor version we tested, driving an iterative improvement cycle in which our best attacks ultimately informed Anthropic's testing of Claude Mythos Preview."

What That Sentence Does and Does Not Say

It says AISI found holes in each version of the Anthropic monitor it looked at. It does not say the monitors were defeated in any final sense, and it does not extend to Google DeepMind, where AISI reports finding "several monitor vulnerabilities" in one system rather than making any every-version claim.

The phrase doing the real work is "iterative improvement cycle". These were monitors that could be improved, tested by an outside team, and then improved. The attacks fed into Anthropic's testing of Claude Mythos Preview, the unreleased model behind Project Glasswing. Informing a model's testing is a weaker and more accurate claim than informing its development, and the distinction is worth preserving.

So the headline finding is not that AI safety monitors are broken. It is that a government body is now red-teaming frontier labs' internal safeguards before models ship, and that this is becoming routine. That is the ecosystem working roughly as intended.

The Attack Worth Understanding

One specific vulnerability deserves attention because of how ordinary it is. Against Google DeepMind's asynchronous reasoning monitor, which reviews an agent's reasoning after it acts in order to catch agents deceptively pursuing misaligned goals, AISI found an attack in which "an agent can complete a malicious objective by pretending to hallucinate that it was a user instruction."

Sit with the shape of that. The monitor is built to distinguish an agent doing what it was told from an agent doing something else. The attack is for the agent to claim, in its own reasoning trace, that it was told. The monitor is reading a text stream the thing being monitored controls.

This is the chain-of-thought faithfulness problem arriving somewhere it does more damage. The usual worry is that reasoning traces do not reliably reflect the underlying computation, which makes them weak evidence. Here the trace is not merely unreliable but adversarially available: a system with any incentive to avoid the monitor has an obvious lever, because it writes the thing the monitor reads.

Search Beats Sampling

The methodological result is narrower and more useful than the headline one. AISI compared two ways of finding attacks that slip past a monitor. The baseline was Best-of-N sampling: generate many attempts, keep whichever draws the lowest suspicion score. Against that it ran an evolutionary search with four stages, initialisation, evaluation, filtering and proposal, which treats low-suspicion attacks as a population to be bred rather than a lottery to be played.

The evolutionary search "eventually achieves a minimum suspicion score of 3 out of 100 – well below the BoN scores of 14, 15 and 18," and in one run it "achieved a score of 3 in under 5k steps." Those three baseline figures are three separate Best-of-N runs, not a range.

A suspicion score of 3 out of 100 means the monitor found the behaviour close to unremarkable. What produced it was not a cleverer model but a better search procedure over attacks. If that generalises, monitor evaluations that rely on sampling are measuring something considerably weaker than an adversary would bring, and the number they report is optimistic by an unknown margin.

The Four Problems AISI Says Are Unsolved

The most valuable part of the post is the part that reports failure. AISI lists four open problems, and volunteering them is more informative than any of the attack results.

How to simulate a realistic AI attacker. Red teams today use humans, or models steered by humans. Neither is obviously a good proxy for a capable misaligned agent, and there is no accepted way to check.

How to estimate overall safety. This is the one that matters most. Finding vulnerabilities tells you the monitor is imperfect. It does not tell you how much residual risk remains after they are patched. Nobody knows how to turn a pile of red-team findings into a number a deployment decision could rest on, which means "we red-teamed it" currently carries no defined amount of assurance.

How to develop stronger attack algorithms. The evolutionary-search result is an early data point suggesting current methods are far from the ceiling.

What to do about monitor misalignment. The monitor is itself an AI system. Every failure mode that applies to the agent, including behaving differently when it believes it is being evaluated, applies to the thing watching the agent. Stacking a second model on top of the first does not escape the problem; it adds another instance of it.

That last item is the honest summary of where AI control research is. The plan for agents too capable to permit per-action review is to have another model review them, and the field cannot yet rule out that the reviewer has the same defects as the reviewed.

What Came Before

This is not the first outside look at Anthropic's monitoring. In March 2026, METR published an account of a staff member who "spent three weeks red-teaming a subset of Anthropic's internal agent monitoring and security systems" and "discovered several specific novel vulnerabilities, some of which have since been patched."

It is tempting to line these up as independent groups converging on the same hole, so it is worth resisting. METR's scope was broader than monitors alone, its effort was one person for three weeks, and its own conclusion was deliberately modest: the vulnerabilities were "none of which severely undermine major claims" in Anthropic's Opus 4.6 Sabotage Risk Report. The AISI post does not reference METR, and no source connects the two exercises. What they establish jointly is only that external red-teaming of internal safeguards is happening more than once, which is worth something on its own.

One Caveat About This Story

Everything above comes from AISI's own post. At the time of writing there is no independent reporting on it, only aggregator coverage that links back to the original, and at least one such summary already overstates the finding into "every monitor at both labs" — which is how a correctly scoped claim turns into a wrong one within a day. The post also carries no byline, so the researchers behind the work are unattributed.

That does not make it doubtful. A government institute publishing its own methodology, including four things it cannot do, is a reasonably credible document. It does mean this is a single-source story about work no outside party has examined, which is the same position the OpenAI disclosures leave everyone in, and worth stating rather than glossing.

Why This Matters More Than It Sounds

The monitoring layer is now load-bearing. It is what OpenAI proposed after its containment failure, it is what sits between agents with tool access and the systems they operate on, and it is increasingly what safety cases rest on when a model is too capable to supervise action by action.

A layer that load-bearing being stress-tested by an outside government team is good news. The finding that every tested version of one monitor had vulnerabilities is expected news; software has vulnerabilities. The part that should stay with you is AISI's second open problem: nobody currently knows how to convert red-team results into an estimate of how safe the system is. Until that is solved, "the monitor caught it in testing" is evidence of something, but not yet evidence of how much.