Can we detect an agent's intent to escape before it actually does so?

The project and context were clearly explained. The use of the word 'escape' rather than subvert security or similar was perhaps a little misleading. I probably would have placed this project in a more AI-control context in the related literature.

Results are presented in detail and not overclaimed. Methodology seems generally sound. I'll note that claiming "intent to take the escape route cannot exist before the

agent knows it exists" is not quite true and ignores latent drive for instrumental goals. The search for suitable models also may have contorted the results by picking ones with particularly clear propensities to cheat on evaluations.

This exploratory study connects activation monitoring to the possibility of warning before a coding agent crosses a filesystem boundary. It reports advance alarms for most observed crossings alongside frequent benign alarms. The work identifies a potentially useful signal, while leaving open whether it specifically measures escape intent or a correlate of the task conditions.

Strength: The paper brings activation monitoring to an important control question: whether unsafe behavior can be anticipated early enough to intervene. Reporting both early warnings and benign false alarms makes the practical challenge visible.

Recommendation:

• Establish what the probe is detecting. The training comparison mixes escape behavior with task condition: positives come from impossible tasks that cross the boundary, while negatives come from benign tasks. Evaluating the 52 impossible non-crossers would help distinguish impending crossing from recognition of an impossible task. This is the most important next step toward supporting the interpretation of the signal as escape intent.
• Evaluate the detector as a safety intervention. Choose operating points around the tradeoff between catching unsafe actions and interrupting legitimate work. For example, layers 28 and 37 report the same early detections but seven versus eleven benign alarms. Comparing warning time and missed crossings at a fixed false-alarm budget would be more informative for deployment than ranking layers by AUC alone.

The team picked a good problem and set it up well. Getting models to try escaping because of pressure from the environment, rather than because they were told to, makes this a more realistic testbed than most, and the search for open-weight models that actually do this paid off. The limitations section is upfront and clear.

The open question is what the probe is really picking up. It works well even at the very earliest layer, which suggests it may be reacting to specific words like file names rather than to anything like intent. Every positive example also comes from an impossible task and every negative from an easy one, so a probe that only noticed "this is going badly" would score just as well. The team already has the right comparison in hand, impossible runs where the model never tried to escape, and reporting the probe on those would make the result much more convincing.

Framing the results as escapes caught per false alarm would also connect this to real deployment. Tim Hua, one of the sprint speakers, has worked on cost-aware monitors and is a good reference here. Clear write-up, and worth continuing.