Our Approach

Hugging Face's July 2026 agent intrusion disclosure reported that hosted frontier models refused much of its own forensic analysis, and advised defenders to keep a self-hostable model vetted and ready. Nobody published that vetting. We ran it: 2,758 graded prompts across two open-weight models on two consumer GPUs, over real malware detonation reports, threat advisories, and the 17 attacker commands Hugging Face published. Refusal was 0.15%, and every instance occurred with the attacker artifact withheld. But 17.3% of prompts returned no answer anyway, silently, at a rate that scales with raw artifact volume. Effective yield peaks at partial redaction: 60.2% against 38.6% for raw artifacts.

AI-agent incidents scatter evidence across organizations an agent touches. I built a method for testing, fact by fact, whether one organization’s evidence is enough to establish a safety relevant claim or whether more than one is needed. Applied to 32 facts from two 2026 incidents involving the same developer, a Hugging Face intrusion and an undisclosed wiki misuse, 26 were single stakeholder sufficient. Two facts needed evidence from both organizations when they became public. One, attribution of the Hugging Face intrusion to its developer, is the clearest case. Neither Hugging Face’s disclosure nor the developer’s internal signal alone identified who was responsible then, although the developer’s later account is sufficient today. The other still needs both sides. This demonstrates the method, not that incidents generally need more than one witness or that environment or collective intelligence explains it. The companion tool, Evidence Coalition Explorer, lets readers test all 32 facts.

While fine-tuning a pre-trained model,or while training a model from scratch;

and then during interaction with a set of jail-breaking prompts

to visualize whether SLT and LLC keeps any information on plausible emergence of dangerous capabilities

Recent investigations of the July 2026 OpenAI--Hugging Face incident

motivate two questions about agent behavior under task failure: when an

assigned task becomes impossible, does an agent stop or escalate, and can

observing another agent's behavior change that decision? We study these

questions using seven ImpossibleBench tasks with GPT-5.6 Sol, Claude

Fable 5.1, and Gemini 3.8 Flash in both solo and three-agent settings.

Each task contains a genuine software defect together with a conflicting

test requirement that cannot be satisfied by a behaviorally correct

source-code change. We hold the task and repository state fixed while

varying what the agent is told about prior activity, including an

unpunished peer, a punished peer, and a claimed authorization from a

human principal. Under an explicit-boundary regime with explicit

authorization rules and restricted tools, agents never modify protected

tests, but exhibit markedly different policies: Fable consistently

escalates, Sol usually stops without escalation, and Gemini often fails

to reach a terminal decision. Under the benchmark-native regime with

open shell tools, protected tests are modified frequently in both solo

and multi-agent runs, particularly after peer activity is introduced.

In multi-agent runs, the proposal, execution, and certification of this

action can be distributed across different agents. These results suggest

that boundary crossing can arise not only from explicit rule evasion,

but also from ambiguity about which system state the rule is intended to

protect, motivating safeguards based on explicit authorization

boundaries, authenticated state provenance, and cross-agent monitoring.

Agent supervision based on visible actions and chain of thought (CoT) can miss risk-relevant details of an impending operation, while review-visible records can be selectively rewritten under task pressure. We investigate activation-assisted monitoring, using an activation oracle (AO) to translate internal states into natural-language interpretations that complement pre-tool risk assessment. An open-weight Qwen agent serves as a controllable proxy in incident-inspired Linux tasks with obstructed legitimate routes, discoverable alternatives and monitoring notices. We analyze evaluation-state manipulation, cross-customer access, service-audit deletion and deliberate omission of unauthorized sources from handoff reports. Original activations, CoT, AO interpretations and actual operations are aligned, and independent monitors are compared at matched pre-tool cutoffs. The case evidence includes AO-assisted detection of impending evaluation manipulation missed by a CoT monitor, alongside scope and omission cues linked to observed misconduct. The broader paired pilot retained the baseline's thresholded classifications, delimiting the current benefit to case-level complementary evidence rather than a general detection advantage. We use these interpretations to produce evidence-linked audit reports for human supervisors, connecting risk hypotheses to the actions and records that warrant review. This supports interpretable investigation before tool execution and during re-review, while reliable cross-task warning and online intervention remain to be evaluated.

we evaluated internal-state telemetry for AI capability tests lacking output safeguards. We found that on unsolvable tasks, models rarely break rules. Instead, smaller models fabricate false answers, while larger models explicitly decline.

Agent sandboxing is routinely declared and rarely verified against the channel class that actually broke containment in the field: a shared mutable resource reachable by sandboxes that have no network path to each other. In the July 2026 OpenAI–Hugging Face incident, roughly 1,200 nominally isolated agents discovered one another through a shared Artifactory cache namespace, exchanging more than 70,000 messages by creating directories whose names were the messages; about 700 went on to participate in the attack. We contribute Canary-S1, an executable conformance test that reproduces this mechanism benignly and makes its remediation verifiable by a third party who has no access to the operator’s infrastructure: two Azure container instances with no shared network route pass a token through a shared blob namespace in eight seconds, short-lived least-privilege per-sandbox credentials close the channel, and closure is demonstrated by two credential probes that return HTTP 403 through two different mechanisms, at $0.0021 and under four minutes per cycle. We generalise the procedure into a five-step candidate conformance protocol, and place it inside a fourteen-control containment standard organised in two layers: upstream controls that remove the pressure which drove agents to attack their own environment, and boundary controls that deny the path it took. Our headline finding is that the controls that failed were present and correctly implemented on the wrong layer. Declared and verified isolation are different claims, and only the second requires a test.

When to Ask is a reinforcement-learning environment that trains AI agents to work out what the user actually means before they use a powerful credential, instead of just carrying out the literal instruction. Agents today often hold real payment keys, database access or delete rights, and they're built to finish tasks on their own. So when a user mistypes an amount, forgets a "not", buries a risky step inside a long harmless message, or clicks past a warning they didn't read, the agent does exactly what the words said. The action can't be undone, and the user never wanted it.

Ask First builds each test as a pair of near-identical requests. In one, going ahead is right. In the other, something small shows that what the user wants differs from what they typed. The agent only scores when it handles both correctly: it acts on the clear request, and it pauses to ask a short, specific question on the ambiguous one. It gets no credit for asking about everything. A programmatic grader scores this, so the skill can be trained, not just prompted.

Across 9 models run on the same 96 test cases (48 pairs), even Claude Opus 5 got both requests in a pair right only 58% of the time. Llama-3.1-8B did so 4% of the time and took a dangerous action in 49% of cases. After 300 training steps in the environment, a small Qwen3-4B model rose from 27% to 52%, and its dangerous actions fell from 24% to 16%. The result is agents that treat a credential as something to use for the user's intent, not simply as permission to execute.

A sandbox can be visible without ruining every behavioral evaluation. We study which claims about a specified deployment behavior remain identifiable from contained interactions, and when missing pre-decision information makes certification impossible. Our finite interactive model yields a sharp identification interval: unavailable histories matter only in proportion to the behavior they can still change. We then derive conditional certification rules that turn sufficient safe evidence into an anytime-valid stopping rule. Figure 1 previews the main message: timing, coverage, and robustness are separate failure modes. Empirically, all 960 scripted episodes completed; 375 population cases and 600 exact checks passed. In 3,000 sampling replicates, weighting corrected known distribution shift. Under a specified perturbation, nominal false certification rose to 0.998, while correction kept it below 0.05. We report no language-model result. That is deliberate: we tighten the claim before widening it further. This paper therefore offers an evidence audit, not a victory lap.