How an assessor could investigate control and monitoring of internal AI agents

Control assessments study whether AI developers’ agents could get away with serious harm without being stopped by the developer’s security and oversight measures. Currently, developers rely heavily on monitors to catch potentially harmful AI behaviors. Here, we discuss how an assessor could collect evidence about the reliability of monitoring. We currently consider five core sub-questions:1 Monitor coverage: What fraction of internal agentic inference is (and should be) monitored? Monitor system vulnerabilities: Can internal AI agents prevent trajectories from being monitored, e.g. by breaking or compromising the monitoring system’s infrastructure? Monitor evasion: If monitoring is active, how easily can AI agents sneak misbehavior past monitors? Response, including human evasion: Where needed, do flagged incidents get reviewed by humans promptly? Is it easy to sneak misbehavior past the human reviewers, even when this misbehavior is flagged by LLM-based monitors? Impact: Broadly, what is the worst misbehavior agents could conduct without getting caught? How easily could they evade other observability and security instruments? What level of persistence could they achieve internally or externally? We will update these sub-questions as new capabilities and misaligned behaviors emerge. Why focus on assessing monitors? The proposal focuses primarily on LLM-based monitoring of AI agents. When AI agents…