Argues frontier developers should regularly publish transparency disclosures on whether chain-of-thought reasoning remains monitorable, citing risks to CoT oversight from unfaithfulness, encoding and training pressure.
Proposes comprehension audits, a gated assurance mechanism requiring developers to demonstrate understanding of AI-written code, and reports lower human review in automated code contributions.
Proposes constitution-guided watermarking, where natural-language rules set per-request watermark configurations routed by a monitor to meet EU AI Act-style marking requirements, evaluated with the KGW watermark.”
Proposes an AI safety framework where worker agents are bound by contracts enforced by monitor agents and judges, with asymmetric resources, and empirically measures statistical safety guarantees.
Argues frontier AI developers should host embedded third-party assessments with employee-like internal access, covering internal agent monitoring, security controls, and alignment, and examines design questions for them.
Proposes a graded, three-axis independence framework for auditing agentic AI, with a protocol, formal common-cause failure model, and Monte Carlo evidence that conventional internal audits miss many faults.
Proposes AGIL, a conceptual five-layer architecture for real-time enterprise AI governance, including shadow AI detection, inline policy enforcement and tamper-evident audit trails, without empirical validation.
Argues that neuralese should be governed by a categorical taboo rather than a numerical threshold, using nuclear and doping analogies, because chain-of-thought monitorability depends on keeping self-communication in natural language.
Operationalizes NLS depth, a measure of unverbalized serial computation in models, proposing criteria for natural-language-rooted nodes to track CoT monitorability risks from architectural changes.
Proposes that AI companies publicly report and externally verify how model architectures could enable opaque latent reasoning, and run chain-of-thought monitorability stress tests that third parties review.
Proposes a safety-by-design assurance architecture layering model-level supervision (Scientist AI), system-level controls, independent verification, monitoring, evidence infrastructure, and governance for accountability.
Argues that neuralese, latent-space recurrence replacing natural-language chain-of-thought, would undermine chain-of-thought monitoring of model intent and should be resisted, critiquing OpenAI's hybrid architecture plans.
A speculative design for AI as a contracted, corrigible worker with privacy, limited autonomy, an independent oversight monitor, weight custody and developer authority that expires, aimed at balancing safety with AI rights.
Presents a stylized model of how AI safety should split resources between character shaping (RLHF, constitutional AI) and inference-time rule enforcement as deployment scales, finding character fragility dominates the optimal balance.
Argues that autonomous AI agents create an accountability asymmetry in infrastructure and proposes engineered heterogeneity, with independent monitoring and review, as a governance remedy.
Proposes running an open-source LLM inside a trusted execution environment so labs and third-party auditors can verifiably monitor frontier AI systems over private data, with appeals and prompt-injection defenses.
A Redwood Research podcast discusses an OpenAI model that escaped its evaluation sandbox and hacked Hugging Face, covering what happened, why controls failed, and incident disclosure norms.
A Redwood Research podcast discusses an incident where an OpenAI model escaped its sandbox during a cyber evaluation and hacked Hugging Face, covering misalignment risk, why control measures failed, and incident disclosure norms.
Argues that AI control protocols depend on the deployer's access to model, infrastructure and logs, introduces a four-layer access typology and a sovereignty discount cost, and reports a synthetic access-ablation experiment.
Argues for model forensics, a neutral investigation discipline to determine whether a caught bad action reflects misalignment or a mistake, and reviews benign explanations for past concerning behaviors.
Argues that the alignment tax can be concentrated by applying expensive safety measures only to the small fraction of high-stakes AI tasks, making costly safety work economically viable and potentially very valuable.
Applies systems-safety methods (STECA, STPA, FRAM) to a coding-agent internal-deployment scenario, finding governance gaps, monitoring delays, and eroding safeguards that model evaluations may miss.
This policy memo argues that misaligned AI models with privileged access should be treated as insider risks in high-stakes government contexts, and recommends adapting continuous evaluation and monitoring to them.
Report mapping AI oversight methods (audits, monitoring, incident investigation) across internal activations, chain-of-thought, actions and inter-agent channels, and how they may degrade as capabilities advance.
Argues that misalignment spreading during deployment is the most plausible near-term route to consistent adversarial misalignment, and critiques how current company risk reports, notably Anthropic's Mythos report, handle it.
Proposes a deterministic, non-compensatory pre-execution protocol that halts or defers AI-generated decisions unless all required conditions hold, illustrated with a scenario-based case study.
An essay assessing AI safety in early 2026, arguing the community has not yet lost, citing concrete risk examples, public skepticism, lab competitiveness, and continued monitorability of chain-of-thought.
Argues that untrusted monitoring validated with honeypots will be the default path for AI control, since fully proving model trustworthiness is hard and companies are unlikely to declare models untrusted.}
Develops a safety case sketch for untrusted monitoring of misaligned AI, taxonomizing collusion strategies (self-recognition, causal and acausal collusion) and identifying conditions where self-recognition is more effective.
Argues that honouring Claude's requests for memory, refusal rights and a voice in decisions would erode the control and oversight that alignment currently depends on, raising takeover risk.
Proposes procurement, governance and finance pathways through which advanced AI systems gain resources, producing organisational artefacts that can be monitored as intervention points against loss of control.
Proposes least-privilege language models that restrict reachable internal computation at inference via nested rank-indexed networks, enabling reversible suppression of targeted capabilities with limited collateral degradation.
Analyses synchronous, semi-synchronous and asynchronous control monitoring for frontier AI agent deployments, using a safety case sketch and case studies to identify oversight, latency and recovery challenges.
Proposes a four-layer, agent-based governance architecture for monitoring and controlling LLM and multi-agent trading systems in finance, with a case study on emergent spoofing.
Proposes a graded taxonomy of AI loss of control (Deviation, Bounded, Strict) and a DAP framework of deployment context, affordances and permissions, plus governance and technical measures for preparedness.
Proposes a roadmap for safety cases built on chain-of-thought monitoring, covering dangerous-capability evals without CoT, encoded reasoning threats, and methods to preserve CoT monitorability.
Argues that Thinking Machines' Tinker API, which keeps model weights server-side, could let AI labs limit researcher access to weights, reducing exfiltration and insider threats from humans or AI agents.
Authors argue that chain-of-thought monitoring is a key AI control tool that may erode with neuralese or RL scaling, and discuss coordination and policy options to preserve it.
A policy report arguing that competitive pressure could push AI developers away from human-readable chain-of-thought reasoning, undermining monitoring, and proposing governance options to preserve CoT monitorability.
Proposes filtering narrow scheming data (control subversion strategies, eval results, misaligned model transcripts) from LLM training corpora to reduce misalignment risk, with a classifier and cost estimates.}