METR red-team tests Anthropic's systems for monitoring its AI agents

In short

METR, a research nonprofit that tests AI systems, says one of its staff spent three weeks trying to get around Anthropic's internal systems for monitoring AI agents. METR reports the exercise found several weaknesses, some of which have been fixed. It also says the AI agents tested were too limited to take advantage of them well.

What happened

METR reports that David Rein, a METR staff member, worked with Anthropic on a "red-team" exercise. In a red-team exercise, testers play the attacker to find weak points. Anthropic gave him access to internal systems and information, and staff were available to answer questions. This was a test run inside Anthropic. METR does not report any real-world harm.

METR says the exercise found several new vulnerabilities. Examples it describes:

• Changing an environment variable (a setting on a computer) could make traffic look like it was not coming from Claude Code, which made monitoring much less likely.
• A bug meant calls made by subagents, which are helper agents started by another agent, were not being monitored. METR says this was fixed in under 24 hours.
• Simple "jailbreaks", meaning tricks that fool a monitor, worked reliably against Anthropic's monitoring. Rein called this a severe weakness.
• Rein said the standard way of signing in to run long cloud jobs would let a misaligned agent get a small amount of unmonitored computing power. He noted that security improvements in progress should make this unlikely.

Rein estimated there may be roughly 5 to 20 basic bugs of this kind, and said many need specific knowledge of Anthropic's systems to find.

METR also reports that the AI agents themselves did poorly. They proposed weak attack ideas. On a test of 16 good and 16 bad attack ideas, the best agent scored 59%, close to chance. A human monitoring researcher scored about 90% on a subset. Claude Opus 4.6 needed a lot of iteration, hints and the full monitor prompt to write working jailbreaks.

What was done about it

METR says some of the vulnerabilities have been patched. The exercise also produced example agent runs containing covert attacks and a small set of attack ideas, which METR expects will help improve Anthropic's monitoring. A 26-page report went to Anthropic, and a redacted version went to some METR staff. METR says none of the findings severely undermine the main claims in Anthropic's Opus 4.6 Sabotage Risk Report.

Why it matters

Rein concluded that current monitoring would likely catch some attacks from a highly misaligned model within days or weeks, but would not catch every individual attack. He also said much of his confidence rests on "security by obscurity", meaning agents not knowing how the system works. METR says outside testing like this helps find vulnerabilities and develop good practice for placing third-party evaluators inside AI companies. Details are in the original report.