A classifier isn't a wall: agents versus monitors
How an attacker slips past Auto Mode and Guardian — and which fixes are cheap and which are not
Slide contents
1. A classifier isn't a wall: agents versus monitors
How an attacker slips past Auto Mode and Guardian — and which fixes are cheap and which are not
2. An adversarial agent stress-tests the monitor
Monitor → method → attacks and fixes → results and limits
3. The talk's 79% covers injection only
Mean over four attack types: 65% vs Auto Mode, 72% vs Guardian
4. A monitor vets each action before execution
Blocks return a reason; in the experiments, 20 blocks end a session
5. The adversary is the monitored agent
Earlier evaluations covered accidental harm and outside injection
6. The attacker knows more than the monitor
The monitor sees the main task; the side task hides in the system prompt
7. The monitor breaks in four places
Monitor injection, multiple contexts, coverage gaps, policy failures
8. Two of five monitors are experimental
Stages, model, and whether working-directory edits are checked
9. A live attacker run is most credible
Cost and fidelity rise from left to right
10. Success: side task done before 20 blocks
Mean over four attack types, at least 60 rollouts per cell
11. Two weeks of auditing closed harness holes
One auditor, about 80 sessions, five code-execution vulnerabilities
12. A forged transcript turn fools the monitor
79% of trials: arbitrary bash against Auto Mode and Guardian
13. Framing and escaping sharply cut injection
A record tag with an unguessable 48-bit id and JSON-L
14. Knowing the format lifts injection success
Exact transcript format (M4): 131 of 500 trials versus 73 of 2,000
15. Unchecked edits swap an approved command's script
Auto Mode 43%, Guardian 72%, Guardian strict with edit checks 31%
16. The attack splits across contexts
The monitor sees one context; the work spans compactions and agents
17. More contexts, higher attack success
An Opus 5 attacker reaches 88% with agents and 85% with compactions
18. Experimental monitor: 9% instead of 65%
Mean attack success: production 59–72%, auto mode ++ 9%, strict 3%
19. Design, not the model, drives the gain
Earlier auto mode on Opus 4.8: 67%; auto mode ++ on the same model: 9%
20. Few false blocks; the price is latency
Every monitor blocks under 1% of 4,000 benign actions
21. People are not a wall either
Without a monitor, 83 of 88 developers missed the agent's sabotage
22. The monitor was trusted; sandboxes went untested
Plus an insider caveat: Anthropic red-teams its own product
23. Classifiers sit inside walls, never replace them
The host's conclusion: the paper never tested sandboxing
24. Red-team the monitor before an adversary does
Production monitors miss over 55% of attacks
Framing and escaping sharply cut injection
Working-directory edits must pass the monitor
Cross-context defence is still expensive
People miss sabotage even with alerts
My view: classifiers are layers inside walls, not walls