The BaseResearchMETR
AI systems could cover up misbehavior
In a METR blog post, David Rein argues that the logs and transcript viewers used to review AI agents must be treated as security-critical. METR reports a researcher, helped by an AI agent, found a flaw in the Inspect viewer in about 10 minutes that could let an agent hide its actions. METR says no agent was seen exploiting it.
Why it matters
The same thing, for different readers.
What it means for you
If an AI can change the records people use to check its work, people could miss it doing harm. METR found that kind of hole; it is fixed.
For lawmakers
Oversight that relies on logs and transcripts assumes those records can be trusted; METR argues for tamper-proof logging and stress-testing monitoring systems against an adversarial AI.
For researchers
A proof-of-concept showing an agent's own output can attack the evaluation tooling, arguing evaluators should treat transcripts, reasoning and actions as untrusted input.
The question it raises
If people can only see what an AI lets them see, what does human oversight of AI actually mean?
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“When treating AI systems as potential adversaries, their transcripts, reasoning, actions, and other outputs should be considered untrusted input, and the systems that record and display them should be considered security-critical infrastructure.”
“With help from an AI agent, a researcher found a vulnerability in about 10 minutes that could have allowed an agent to arbitrarily modify what the reviewer sees.”
“We have not observed agents exploiting this in any of our evaluations; this is just a proof-of-concept exploit.”
“If AI systems can reliably conceal what they are doing, we won’t be able to detect and respond to increasingly serious misaligned behavior.”
“Speculatively in the worst case, AIs could create a kind of Potemkin village, where everything looks normal to human engineers and researchers”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- A security test on an isolated staging sandbox: METR checked whether an AI agent running inside an evaluation built with Inspect, a widely used safety-evaluation framework, could change what a human reviewer sees in Inspect's transcript viewer. One researcher, helped by an AI agent, looked for a vulnerability.
- What it found
- The researcher found, in about 10 minutes, a flaw (script injection through the viewer's rendering of math) that could let an agent arbitrarily change what the reviewer sees, including earlier actions and the transcript download. The underlying transcripts were not changed, and in METR's setup the real trajectory would still be in its database. Inspect's maintainers patched the flaw within one day of the report.
- What it does not show
- A proof-of-concept exploit, not an observed attack: METR says it has not seen agents exploit it in any of its evaluations, though a footnote adds that it has not searched its logs for this specific exploit and expects a broader search for misalignment or security incidents would have flagged an attempt. The flaw is narrow, affecting only what the viewer shows. The post's wider scenarios of agents covering up evidence are labeled speculative.
- Status
- A report
The record
- Questions
- Can AI systems act beyond what people intended or allowed? · Are AI companies putting stronger safeguards into practice?
- People
- David Rein (Wrote it)
- What we read
- We read the whole source.
- Found by
- The Radar, run of October 12, 2026, via
metr(tier 1: the source’s own channel or an official record) - Cite this
- METR, “AI systems could cover up misbehavior”, October 6, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/metr-2026-10-06-ai-could-cover-up-misbehavior