How an assessor could investigate control and monitoring of internal AI agents

METR sets out how an outside assessor could test whether AI developers' monitors of internal agents work: how much activity is covered, whether agents can break monitoring, whether monitors miss misbehaviour, how human review responds, and what damage could result.

Why it matters

The same thing, for different readers.

What it means for you

Companies mostly rely on automated monitors to catch AI agents misbehaving; this describes how an outsider could check whether those monitors actually work.

For lawmakers

Lists the logs, code and system access an outside tester would need, which could inform what regulators or contracts ask developers to provide.

For researchers

Sets out five sub-questions, from monitor coverage to human-reviewer evasion, including testing for collusion between monitors and agents.

The question it raises

Raises whether oversight that depends on AI watching AI can be trusted when the watched systems may be able to coordinate.

In their own words

Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.

From the source’s own text.

“Monitoring AI agents with an LLM which is able to make sense of what those agents are doing is therefore a critical part of automated oversight at scale, and is the primary source of evidence inside frontier AI developers about AI misbehavior.”
METRMETR on why its control assessment focuses on LLM-based monitors.
Found word for word in the source
“Agents might pass up some opportunities to attack while taking others, and highly capable agents may prioritize attacks so difficult to detect that the developer would reliably miss them.”
METROn why an assessor should search large pools of transcripts for attacks agents declined to make.
Found word for word in the source
“we expect it to become increasingly important to assess the extent to which monitors and agents could successfully collude without their developer knowing.”
METROn the possibility that monitors and agents coordinate to avoid flagging misbehaviour.
Found word for word in the source

The record

Questions
Can AI systems act beyond what people intended or allowed? · Are AI companies putting stronger safeguards into practice?
What we read
We read the whole source.
Found by
The Radar, run of October 15, 2026, via metr (tier 1: the source’s own channel or an official record)
Cite this
METR, “How an assessor could investigate control and monitoring of internal AI agents”, October 14, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/metr-2026-10-14-control-monitoring-internal-agents
Our notesA method proposal; it reports no assessment results. Part of a set of four METR posts of the same day.