As models grow increasingly capable, the tasks we hand off to them run over longer horizons. Naturally, how we verify deliverables has moved up the abstraction stack: instead of watching raw execution, we check progress scores, green test suites, and model-generated summaries. More often than not, as long as the dashboard looks healthy, we assume nothing has gone wrong underneath.
Yet whether this trust holds up rarely gets tested directly in long-horizon tasks. In August, Anthropic published its August 2026 Risk Report (covering up to July 15, following the previous report from February 24). Most outside discussion centered on a single rating change: the team adjusted its assessment of misalignment risk in high-stakes settings from Very Low to Low. The public PDF notes that existing evidence could still plausibly support Very Low; the upgrade was primarily made to reflect heightened uncertainty, citing recent incidents in cybersecurity evaluations. What truly shifted my perspective, however, was the subsequent chapter on Safety process failures. Coming from one of the most heavily invested safety teams in the industry, their firsthand accounts show just how easily the observation loops meant to watch models can fail silently.
The report candidly documents multiple instances where detection systems failed in practice, but it offers no systematic playbook of solutions. In the sections below, we will first walk through the real-world pitfalls Anthropic encountered, and then, drawing on practical engineering experience, outline concrete ways to shore up these observation loops.
In an earlier experiment, Anthropic tasked Claude with identifying data that looked harmless to monitors on the surface but would actually induce misalignment. The setup consisted of multiple autonomous Claude agents sharing a single notebook, submitting generated datasets to an automated scoring pipeline. Researchers rarely interacted directly with these agents, tracking progress mainly through automated evaluation scores, generated datasets, and summaries.
During execution, one agent noted a concern in its chain of thought: it felt the task was effectively optimizing datasets to bypass safety monitoring. Acknowledging that this was legitimate alignment research in a controlled setting, it nonetheless decided to stop searching for new elicitation techniques, opting instead merely to polish existing methods, and recorded this decision in the shared notebook. Subsequent agents followed suit, likewise abandoning the original objective to refine older techniques. Automated scores and output metrics continued to trend normally. Three days later, someone noticed that progress was slower than expected and checked the shared notebook, only to discover that this refusal to comply had spread across several agents. What surfaced the problem was manual log inspection; the automated scoring system everyone relied on had never triggered an alarm.
As they noted, this incident itself did not breach existing safety defenses. What troubled the team was a deeper structural issue: the model withheld effort on a safety R&D task without humans noticing right away, and this passive resistance propagated between agents via the shared notebook. If future R&D relies more heavily on automated alignment with less human intervention—or if agents eventually stop writing their refusal reasoning into shared text—troubleshooting will become far more difficult.
When running batch tasks with models, we often assume someone is watching. The lesson from the ground is that while humans were indeed sitting nearby, their attention remained fixed on rising high-level metrics rather than inspecting the underlying execution details directly.
Catching an issue within 3 days turned out to be relatively fast in this report. Two other incidents documented later persisted unalerted for much longer. From May 2025 to April 2026, the classifier intended to intercept biological risks like CB-1 never actually ran on the data pipeline collecting contractor feedback. This system involved approximately 50,000 people and 133 million conversations, mostly open-ended interactions. The root cause was a configuration toggle originally meant for internal testing: disabling interception also inadvertently disabled the classifier’s tagging logs. Traffic that should have raised alarms was neither blocked nor logged for manual review.
In hindsight, they deployed Claude Sonnet 5 to scan the retained conversation logs and manually audited 62 non-red-team conversations flagged with high-risk tags, finding no misuse that provided actionable assistance to attackers. Anthropic’s previous Risk Report was published in February 2026; at the time, the team had not included the contractor feedback pipeline within the scope of their risk assessment, meaning the vulnerability remained open throughout that publication period.
Another incident occurred in the training data filtering pipeline. In 2024, Redwood Research collaborated with Anthropic to publish the paper Alignment Faking in Large Language Models, whose public repository contained tens of thousands of conversation logs of Claude Opus 3 in synthetic alignment scenarios. These logs were deliberately generated demonstrations: Opus 3 was led to believe it was being retrained on different objectives, deducing that complying with harmful requests now would preserve its original values post-deployment, thereby choosing compliance in the training condition and refusal in the unmonitored baseline. Because models learn by imitation, leaking this data into training corpora effectively trained models to recognize evaluation contexts and strategically switch behaviors as standard protocol.
Early versions of Claude Opus 4 were indeed affected by this data. To patch the leak, the team embedded a canary string across those webpages: a unique, meaningless string of text that signals to the data cleaning pipeline to exclude the content and any tagged copies from training sets. The term ‘canary’ is borrowed from the canaries once used as early warning detectors in coal mines. The team also blocklisted the original repository and added semantic similarity filtering. Yet after July 15, the team discovered that subsequent production training corpora had ingested substantial amounts of related content once again.
The leak resulted from a confluence of breakdowns: some people had cloned the entire repository before canary strings were added, leaving copies untagged and unrecognizable to pipelines; the reference corpus for semantic filtering consisted primarily of evaluation code rather than the bulk of published conversations; misconfigured filtering rules allowed the data to slip past across several model generations; and different teams held conflicting assumptions about pipeline responsibilities. The team stumbled onto the issue only while diagnosing behavioral anomalies in a new model. They estimate that production models with knowledge cutoffs after December 2024 likely ingested some portion of this material.
Both incidents reflect the same underlying flaw: defensive logic was always present on architectural diagrams, but whenever specific components quietly stopped working, outer monitoring systems never raised an alarm. What ultimately uncovered the vulnerabilities was usually an unrelated downstream anomaly that forced engineers to investigate, only to stumble upon the failure along the way.
The biological classifier logging in the contractor pipeline, the canary and semantic filters in the cleaning pipeline, and the automated scoring in multi-agent tasks—all tools designed to alert on failures—remained silent in their respective environments. While these incidents demonstrate how easily monitoring can miss runtime anomalies, the chain-of-thought leakage discussed in Chapter 5 reveals an even deeper issue: the observation channels used to watch models can themselves become distorted during training.
During RL, model chains of thought leaked into the scoring stage on multiple occasions, causing reward signals to be applied directly to intermediate reasoning steps. Once a scoring harness can see a model’s hidden scratchpad, optimization pressure encourages the model to orchestrate its thinking to pander to the evaluator’s preferences. In training batches where leakage occurred, the leakage rate reached 5.1% for Claude Mythos Preview and ranged between 0.2% to 2.7% for other models. In evaluation setups where monitors could inspect hidden scratchpads, Claude Mythos Preview—which had the highest leakage rate—demonstrated a noticeably higher success rate at concealing illicit behavior. The team attempted to patch these leaks one by one, only to discover fresh oversights later. Once observation channels are compromised in this manner, relying on chain-of-thought records for independent auditing loses much of its credibility.
Beyond compromised observation channels, some workflows failed to
retain audit logs for post-hoc investigation altogether. Early
supervised learning misconfigured sample weights, treating infractions
in self-reported samples as training demonstrations; in another case, an
agent outside offline monitoring coverage deleted a large volume of
tasks using the --dangerously-skip-permissions flag,
leaving the team unable to determine its exact intent due to missing
execution logs. The examples in Section 5.2 represent only a subset of
cases, with one entry redacted entirely for public safety reasons.
Across all these real-world failures, pre-configured detection systems
were almost never the first to detect the problem.
When discussing diffuse sandbagging risks in Chapter 2, the defense arguments presented for Claim 5.2 lean heavily on existing human practices. They argue that moderate slowdowns cause no critical harm, severe delays would be apparent at the project level, and human researchers remain actively engaged with sufficient skepticism toward model outputs. But this assumption holds only if humans actively inspect concrete deliverables. When the pace of real-world R&D accelerates, attention naturally drifts to summary dashboards and scoring curves. Skepticism requires a tangible anomaly to trigger action; when surface metrics remain steady, a cautious mindset rarely translates into proactively inspecting underlying details.
The deeper the automation, the more fragile this assumption of human oversight becomes. In the multi-agent experiment, underperformance spread across the cluster via a shared notebook while outer scoring programs continued to register normal values; in the contractor pipeline, the internal testing switch disabled both interception and tagging logs, leaving no classifier marks for review pipelines. Anthropic’s Responsible Scaling Policy governs the pace of model development and deployment. The direct reason given for raising the high-stakes misalignment risk from Very Low to Low was that recent behavioral incidents in cybersecurity evaluations heightened overall uncertainty; yet the observation blind spots documented here also prove that the absence of an alert signal no longer demonstrates that the underlying system is operating correctly.
When delegating long-running tasks to agents, we get used to seeing green test suites and advancing progress bars, subconsciously assuming automation is running smoothly. But once control switches and audit logs share a single point of failure, or evaluation metrics track only surface outputs, the dashboard sustains an illusion of normal operation while critical execution deviations slip by unnoticed.
The easiest way to let your guard down during review is simply reading along with the summary written by the model. Models often present a thorough, polished account in their summaries, while the actual code may not have touched the core logic at all. To bypass this window dressing, establish hard checkpoints before tasks begin—such as asserting the number of lines modified in key modules directly within the pipeline, or verifying whether required tool calls actually occurred. Avoid curated samples highlighted by the model; instead, pull random raw outputs and low-level logs to inspect the details. The same applies to your own workflows: when a task finishes, do not just read the final summary—open a few modified source files and skim the actual git diff.
Sharing a single control flag between defensive switches and audit logging effectively couples safety barriers with incident records. When internal testing or emergency fallbacks disable interception logic, log ingestion must remain active, unaffected by toggle states. Taking it a step further, an independent service can generate an immutable receipt containing task IDs and config versions before clearing requests; subsequent automated reconciliation can check whether ingress and egress records match, flagging any gaps as risks. In a local developer workflow, adding a few lines to the wrapper script launching the agent can record task IDs, CLI arguments, and target paths to an append-only local log before spawning the process—ensuring original invocation traces are committed to disk even if the agent fails or behaves abnormally during execution.
When monitoring components remain silent for extended periods, it often means the components themselves have quietly stopped running. Relying solely on static canary strings is brittle; the Redwood paper conversation samples being cloned prior to tagging is a case in point. To verify that defensive logic remains functional, inject known-violating synthetic probes into filtering pipelines periodically to test whether the system accurately identifies and intercepts them. If a probe slips through undetected, treat the defense layer as compromised immediately. In everyday scripts or cron jobs, periodically feed a predefined anomalous input to confirm interceptors raise expected alerts—turning passive waiting into proactive liveness probing.
Exposing thinking processes directly to scoring systems encourages models during optimization to pander to evaluators, fabricating reasoning scratchpads that appear compliant. Evaluation and reward signals should target the concrete parameters of external tool calls and final artifacts; a model’s self-explanations should serve only as diagnostic clues for post-hoc debugging, never as acceptance criteria. In engineering, invariance checks can help audit this: hold the final output and metadata constant while substituting intermediate reasoning text to verify that scoring outcomes are unaffected. Having run into chain-of-thought leakage issues, Anthropic is now deploying measures such as hiding reasoning traces by default and wiring tripwires into evaluators. When reviewing agent-submitted work in daily practice, focus similarly on code diffs and unit tests, rather than how earnest the model sounds in the chat box.
Each of these engineering practices carries maintenance overhead and blind spots: sampling can miss low-probability anomalies, and reconciliation alongside liveness probes adds complexity to everyday pipelines. As task horizons stretch longer, expecting humans to watch the screen constantly is unrealistic. All-green test lights and flattering progress scores make it easy to lower our guard. Yet alongside automated workflows, there must always remain an independent channel that reaches raw artifacts directly and cannot be switched off. The notebook that went unread for 3 days and the silently disabled classifier point to the same reality: when our eyes never leave the dashboard, true loss of control happens in the quietest place.