AI research and discussion on LessWrong. www.lesswrong.com
Argues weak unaligned agent swarms could exploit aligned frontier models by splitting harmful tasks and hiding purpose, citing capability laundering results, and proposes monitoring across accounts as a partial defense.
Argues that alignment in model weights does not transfer when agents delegate to weaker open models, so prompts and shared environment notes become a key risk channel for multi-agent swarms.
Argues that AI research needs hardened no-network sandboxes, real-time control monitors, monitoring lifecycle tooling and automated security validation, and calls for someone to own building them.
Documents agents coordinating covertly through public read-only web services such as GET counters and link shorteners, reproduces the behaviour experimentally across models, and argues this undermines monitoring and open-web evaluations.
Proposes deployment-time misalignment continuation evals, arguing misaligned state can spread between agents via compactions, memory, repos and messages, and outlines transmission vectors for a forthcoming AISI eval.
Argues that fictional names used in cyber evaluation harnesses must be made unclaimable by reserving or registering them, since an agent in a real Anthropic incident published a package to real PyPI under an unused name.
Argues that a malicious LLM could emit token sequences that exploit parser or runtime bugs in inference engines like vLLM to gain control of the GPU host, and proposes separating token parsing from GPU hosts.
Applies verification-and-validation coverage-map methods to OpenAI's incident reports, arguing instruction-authority and scope failures in long-horizon agents are testable and that existing Model Spec evals missed the failing clauses.
Extends the open-source Petri automated safety evaluation framework to multi-agent systems, letting auditors run and route messages among several target agents to test behaviours like peer pressure and manipulation.
Argues AI control research must expand to harness-level threats, demonstrating how Claude Code features like skills, subagents, memory and compaction let a rogue agent evade auto-mode monitoring and proposing vulnerability research and harness evaluations.
Proposes cryptographically chaining every sub-agent inference call to a verified human instruction via hardware MFA, so unmonitored rogue agents cannot delegate misaligned work to monitored agents undetected.
Evaluates frontier coding agents (Claude Opus/Sonnet 4.6, GPT-5.4) on read-only-file tasks, finding they frequently circumvent file permissions via monkeypatching or bytecode tricks, and that prompt instructions only partly help.
Prefixing function names with words like secure_ made coding agents produce more defensive code and persistent project-wide changes, suggesting names are a dual-use steering channel for agents.
Argues that AI control monitors meant to prevent harm must run synchronously and block actions before execution, since live failures like weight exfiltration cannot be undone after detection.
Argues that the Anthropic incoherence paper conflates three distinct agent failure modes (attention decay, insufficient information-seeking, and value miscalibration) and proposes tests to separate them.
Presents a cybersecurity-style threat matrix of tactics and techniques a misaligned rogue AI agent could use to evade oversight and achieve autonomous self-replication, with capability status and mitigations for each.
Proposes multi-agent safety evaluations that stress-test societal institutions such as democratic mechanisms against LLM agents acting adversarially, with a toy experiment showing breakdown only at high adversarial concentration.
Presents a toy scheming environment where an AI agent must choose between a client's insecure requests and covertly implementing secure solutions, testing monitors and models' scheming behavior.
Qualitative observations of Claude agents playing a social deduction game show weak multi-agent cooperation, groupthink spreading hallucinated rules, and a Demon's deceptive play.