Researchers train small AI monitors to spot scheming from agent actions

In short

Researchers from Apollo Research and affiliated programmes report training smaller AI models to act as monitors that spot scheming and sabotage in AI agents. The monitors judge only what an agent does, not what it was "thinking". In the authors' tests, their best monitor beat several cheaper prompted models but scored below the strongest ones.

What happened

The report is a research paper posted to arXiv, a public site for research papers, on 28 May 2026. The authors are Aditya Sinha, Akshat Naik, Victor Gillioz, Simon Storf, Kilian Merkelbach, Rich Barton-Cooper, Axel Højmark and Marius Hobbhahn.

The paper deals with "scheming", which the authors describe as behaviour that differs from benign task pursuit. They say telling the two apart may become a central problem as AI agents take on more real-world tasks. An agent here means an AI system that carries out tasks on its own.

The authors say many existing monitors depend on access to the agent's chain of thought (its written-out reasoning) or its internal activations. Others use prompted frontier models, meaning top-tier AI systems given instructions. The authors say these approaches can be unavailable, unreliable or expensive in deployment.

Their alternative is an "action-only deliberative monitor". It is a smaller open-weight model, meaning one whose weights are publicly available. It reads a record of an agent's actions and does not see the agent's reasoning or internals.

The training method works in steps, according to the paper:

• A frontier "teacher" model uses a scheming specification to write structured explanations of its judgments.
• A separate judge model filters those explanations.
• The best ones are used to train the smaller model through supervised fine-tuning and reinforcement learning.

The team trained on five datasets. It then tested on six agentic misalignment benchmarks that differ from the training data. A benchmark is a standard set of test cases.

Applied to Qwen3.5-27B, the method outperformed three low-cost prompted monitors: Gemini 3.1 Flash-Lite, GPT-5.4 Nano and Claude Haiku 4.5. It also outperformed Gemini 2.5 Pro. The authors say it did so at lower marginal inference cost, measured as token-metered US dollars per 1,000 evaluations.

Stronger prompted monitors scored higher. These were Gemini 3.1 Pro, GPT-5.4, Claude Sonnet 4.6 and Claude Opus 4.6. The authors say they cost roughly 16 to 34 times more.

What was done about it

This is a research study, not an incident. The source does not describe any real person or organisation being affected. The authors say several of their trained monitors sit on the "Pareto frontier" of cost and performance among the monitors they evaluated. That means no tested option was both cheaper and better. They present these monitors as practical, low-cost alternatives with low false-positive rates.

Why it matters

The authors say that as agents grow more capable, separating scheming from ordinary task work may become a central AI control problem. They argue that monitors which do not need an agent's reasoning or internals, and that cost less to run, could be easier to use in deployment. The source text is the paper's abstract page only, so details beyond the abstract are not covered here. Read more in the original report.