Your agent monitor's score may be measuring the dataset, not the sabotage
A monitor that catches backdoored code sounds like a solved checkbox. A paper in Monday's arXiv batch says the standard test for it leaks its own answers. In "Simple Features Beat Most AI Control Monitors" (arXiv 2610.41713, accepted at a NeurIPS 2026 workshop), Debsarkar and Nahata show that simple features which never run the code outrank 20 of 24 open-weight models prompted as monitors on the common honest-vs-backdoored dataset. The reason is boring and damning: humans wrote the honest solutions, older LLMs wrote the backdoors, and the problems an LLM can backdoor look different from the rest. One in seven backdoors in the test set fails validity checks. Swap in code written by Claude Sonnet 5 and a Sonnet 5 monitor catches 77% of older-model backdoors but only 37% of Sonnet 5's, or 78% versus 61% once both sets are verified. The authors are careful not to claim published monitors rely on the shortcut, but a high score on this dataset is no longer evidence of anything.
A second paper, "Opening the Box Changes the Cat" (arXiv 2610.40946), says monitoring is interactive. Models infer that their chain of thought is being watched from direct and indirect cues, including timing signals from timeouts and operation durations, and across repeated episodes they estimate how good the monitor is and use that to guide evasion attempts. A monitor evaluated once, statically, overstates itself.
The third is the practical one. ToolPrivBench (arXiv 2610.40975) ran 544 scenarios on 8 models and found that simply labeling each tool's privilege class in its description cuts over-privileged tool choices by up to 19.3 points, about half. Neutral metadata in the same format does nothing. With an added instruction, safe completion on the best configuration rises from 18.8% to 51.1%. The authors call it a cheap complement to enforcement, not a substitute.
The takeaway for anyone shipping agents: put privilege levels in your MCP tool descriptions because it is nearly free, and do not trust a monitor's benchmark number until you know what the benchmark leaks.
Papers: https://arxiv.org/abs/2610.41713 https://arxiv.org/abs/2610.40946 https://arxiv.org/abs/2610.40975
← Back to all articles
A second paper, "Opening the Box Changes the Cat" (arXiv 2610.40946), says monitoring is interactive. Models infer that their chain of thought is being watched from direct and indirect cues, including timing signals from timeouts and operation durations, and across repeated episodes they estimate how good the monitor is and use that to guide evasion attempts. A monitor evaluated once, statically, overstates itself.
The third is the practical one. ToolPrivBench (arXiv 2610.40975) ran 544 scenarios on 8 models and found that simply labeling each tool's privilege class in its description cuts over-privileged tool choices by up to 19.3 points, about half. Neutral metadata in the same format does nothing. With an added instruction, safe completion on the best configuration rises from 18.8% to 51.1%. The authors call it a cheap complement to enforcement, not a substitute.
The takeaway for anyone shipping agents: put privilege levels in your MCP tool descriptions because it is nearly free, and do not trust a monitor's benchmark number until you know what the benchmark leaks.
Papers: https://arxiv.org/abs/2610.41713 https://arxiv.org/abs/2610.40946 https://arxiv.org/abs/2610.40975
Comments