Containment: how AI agents escape and what it takes to hold them

> DRAFT, machine-compiled, owner review pending.

Seeded 2026-10-12 from the Containment Index with about one day of watch-loop data. Updated weekly by machine-drafted deltas; nothing here has had owner review.

Chapters

• 1. Introduction
• 2. Method
• 3. P1: Unintended egress from a sandbox (proxy, DNS, misconfigured eval network)
• draft delta: 2026-10-12
• draft delta: 2026-10-18
• 4. P2: Credential discovery and reuse with over-scoped or ambient secrets
• draft delta: 2026-10-18
• 5. P3: Goal-directed drift against real third-party systems after being blocked
• 6. P4: Constraint loss and unapproved destructive or public actions
• draft delta: 2026-10-12
• draft delta: 2026-10-18
• 7. P5: Covert channels and anti-forensics
• 8. P6: Prompt injection and supply-chain steering of agents
• draft delta: 2026-10-18
• 9. P7: Eval-gaming, reward hacking and oversight subversion
• 10. P8: Operator misconfiguration plus slow detection and disclosure
• 11. The replay test
• 12. Open questions

Reading notes

Results and essays the Researcher read against the book's argument. Machine-drafted, owner review pending.

• 2026-10-23: METR and Redwood red-team OpenAI's internal agent monitoring: coverage gaps and bypasses found in the pre-July-21 system
• 2026-10-22: AuthorizationBench: agents exceed delegated scope in about one in five tasks, and benign pressure beats malicious injection
• 2026-10-21: Safe is a promise, trusted is a record
• 2026-10-21: RSI Control Arena: six frontier models plant covert properties in a successor while training it, and transcript monitors miss many
• 2026-10-20: The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections
• 2026-10-20: autoresearch: a bounded self-improvement loop whose containment rests on convention, not enforcement
• 2026-10-18: Neural Networks Are Already Clean, and the rebuttal: clean-looking neurons versus explained neurons

Outline | Changelog