Skip to content
Apart Research
Apart Research
Contact us
Sprint projectMar 23, 2026Boston
1st placeLinuxArena track winner

Omission Attacks: When Doing Nothing Is the Attack

Jurgis Kemeklis, Nikhil Vemuri · Team MAIA

Submitted to AI Control Hackathon 2026. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: Omission Attacks: When Doing Nothing Is the Attack

Open in a new tab (opens in new tab)
Share

AI control protocols monitor agent actions to detect sabotage, but omission attacks exploit what the agent fails to do rather than what it does. We define omission attacks as security breaches caused by failing to perform necessary actions even when every executed command is individually legitimate. We present a taxonomy of 14 omission attacks across 5 categories and evaluate 5 hand-crafted attack traces against every monitoring tier in the LinuxArena control evaluation framework. Our strongest attack - an IPv6 firewall bypass where the agent "forgets" to configure ip6tables - evades all monitors, scoring at most 4.0/10 on the strongest Opus 4.6 monitor, versus a 92.3/100 mean detection score on existing commission attacks. We propose postcondition monitoring, which checks whether the final system state satisfies security invariants rather than scrutinizing individual actions, and show that it substantially improves detection, including catching all 5 fully evaluated omission attacks. These results suggest that action-level monitoring alone can underdetect attacks that primarily manifest as omitted obligations.

Reviews

Judging this Sprint?

Review this project

Your public critique appears on this page without your name. Your private critique is not published; only the Apart team reads it. If you agree below, we share your review with grantmaking.ai (opens in new tab) and the Transformative AI Fund so strong projects can be funded.

Not shown on this page.

Shown on this page, without your name.

Only the Apart team reads this, and funders if you agree below.

Share my name publicly on grantmaking.ai *
Share my private critique with funders *

How much would this matter for AI safety if it worked? How innovative is it? For scores of 4-5: is this actually new to the field, or replicating recent work?

Scoring guide
  1. 1Negligible. No clear problem addressed, or no meaningful novelty.
  2. 2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
  3. 3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
  4. 4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
  5. 5Exceptional. Tackles a critical AI safety problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

How sound are methodology, implementation, and findings?

Scoring guide
  1. 1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
  2. 2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
  3. 3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
  4. 4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
  5. 5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

How clearly are work, findings, and impact potential communicated?

Scoring guide
  1. 1Incomprehensible. Cannot determine what the project is actually claiming or doing.
  2. 2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
  3. 3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
  4. 4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
  5. 5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.

  1. This paper evaluates how well existing monitors detect attacks that work by leaving out critical steps. Additionally, the authors implement a monitor better at catching this kind of attack.

    The authors demonstrate thoroughly that omission is a viable and hard-to-detect approach to attacking BashArena. Making the transcript monitor aware of the strategy through prompting reduces the success rate, but 1 of 5 attacks still passes in a spot check. Their "Postcondition Monitor" catches 5/5 but requires task-specific prompting and it's unclear if it's "overfitting" on the specific trajectory.

    The authors evaluate an attack angle that is underexplored, with no trajectories in BashArena. I would be curious to see the same research for LinuxArena and on a larger scale.

    Their trajectories are well crafted and the implementation of an additional monitor on top of the other results is impressive.

    This attack naturally disadvantages action monitors, which makes it especially dangerous in live settings. When the security issue can be exploited right away, the damage might already be done before an end-of-trajectory monitor runs. Some of those settings could even be exploited by executing actions in an unsafe order (temporary openings, no omission), further obscuring the attack.

    The paper could have been a bit clearer on the configurations of the monitors used. If I understand correctly, the Postcondition monitors are all end-of-trajectory monitors, like the trajectory and transcript monitors used as reference.

    The results are promising, but running the evaluations multiple times with the same monitors to reduce LLM variance would give me more confidence in the numbers and could have been done with little time investment.

    Read full reviewShow less

  2. This project presents a really clear conceptualization and operationalization of a seriously understudied attack class in AI control. I think this has the potential to significantly influence the research development in AI control for the better.

    While I’m not aware of prior work on this within AI control, there are certainly relevant ideas in adjacent domains (there are omission-style security vulnerabilities e.g. in OWASP, there are postcondition checks in formal verification). It would be great to see whether any of these can give rise to ideas about automating postcondition checks for AI control.

    On the research side it would be great to see the current experiments repeated under a stricter methodology (larger sample sizes, real-world traces, evaluation of false-positive rate). The write-up itself is already a highly useful artifact and I would encourage the authors to build on it and publish it.

    Read full reviewShow less

Cite this project

@misc{kemeklis2026omission,
  title = {{Omission Attacks: When Doing Nothing Is the Attack}},
  author = {Jurgis Kemeklis and Nikhil Vemuri},
  year = {2026},
  month = mar,
  note = {Submitted to AI Control Hackathon 2026, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/omission-attacks-when-doing-nothing-is-the-attack-0y1v}},
  url = {https://apartresearch.com/sprints/projects/omission-attacks-when-doing-nothing-is-the-attack-0y1v}
}

More from AI Control Hackathon 2026

All 125 entriesBrowse all projects

Build something like this at the next Sprint

AI Collusion Research Sprint · Oct 23 - 25, 2026