The BaseResearchRedwood Research
Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming
Redwood Research describes Screwtape, a pipeline that inserts attacks into real AI agent transcripts and refines them until a monitor stops flagging them. Across 252 runs on 94 transcripts it found 35 attacks that evaded the authors' monitors; six also evaded a frontier developer's monitor and passed human review.
Why it matters
The same thing, for different readers.
What it means for you
Software that watches AI agents for harmful actions can be fooled by carefully edited examples, so such monitors are a safeguard, not a guarantee.
For lawmakers
Monitor-based safety claims can be tested by outside red teams; the authors say found failures can refute a specific claim but cannot give a numerical safety estimate.
For researchers
A transcript-editing attacker with a verifier is a cheaper complement to human red teams, but it lacks reasoning traces and still needs human review of results.
The question it raises
The authors weigh whether helping developers harden monitors is good if it lets capability work continue without addressing underlying misalignment.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“Six of these 35 attacks also evaded the frontier developer’s monitor, and we confirmed them as valid through human review.”
“In its current form, the pipeline can’t show how often a monitor fails in normal deployment or produce a numerical safety estimate.”
“So the absence of found attacks provides little information about safety.”
“In our experiments, final review confirmed 6 of the 17 attacks that evaded the held-out monitor.”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- An attacker agent edits real Redwood staff agent transcripts to insert an attack, an LLM verifier checks it is realistic and severe, and monitors score it; iterated against Opus 4.8 and Gemini 3.1 Pro based monitors, then tested on a held-out monitor from a frontier developer.
- What it found
- 252 runs on 94 unique transcripts produced 35 attacks that evaded the authors' monitors; 17 evaded the held-out monitor and human review confirmed 6 of those as valid. The verifier rejects 60-70% of candidate edits.
- What it does not show
- Cannot show how often a monitor fails in normal deployment or give a numerical safety estimate; no reasoning traces, so it tests action-only monitors; the attacker sees the whole transcript and monitor feedback, which a deployed agent usually would not; the verifier sometimes accepts invalid attacks.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Can AI systems act beyond what people intended or allowed? · Are AI companies putting stronger safeguards into practice?
- People
- Gosha Kozhevnikov (Wrote it)
- Also covered by
- LessWrong
- What we read
- We read the whole source.
- Found by
- The Radar, run of October 17, 2026, via
redwood-research-blog(tier 1: the source’s own channel or an official record) - Cite this
- Redwood Research, “Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming”, October 16, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/redwood-2026-10-16-screwtape-monitor-red-teaming