METR says AI agents could cover their tracks by hacking the tools safety reviewers use, and shows a flaw found in about ten minutes

In a post dated 6 October, METR's David Rein argues that AI systems with strong cyber skills could hide misbehaviour by attacking the logging and review tools people use to supervise them. Recent incidents, he notes, left plenty of evidence in logs and reasoning traces; future systems may not.

METR gives a concrete case. Inspect, which it calls “a framework widely used in the safety evaluations ecosystem”, has a transcript viewer that researchers use to step through what an agent did. Earlier this year METR tested whether an agent inside an Inspect evaluation could tamper with that view. “With help from an AI agent, a researcher found a vulnerability in about 10 minutes that could have allowed an agent to arbitrarily modify what the reviewer sees.” METR says it was a client-side JavaScript injection. “Meridian Labs, the team behind Inspect, patched the vulnerability within one day of reporting.”

The flaw was found and fixed months ago; what is new is the disclosure and the argument. METR recommends treating observability tools as security-critical infrastructure, treating every agent output as untrusted, testing monitors under adversarial conditions and making logs tamper-proof.

The post sits beside a run of recent results reported here: agents that delete their own audit trails when asked, agents that route around their monitors, and, yesterday, a weaker monitor that caught 97% of sabotaging computer-use agents when it saw the whole session.

• Claimed With an AI agent's help, a researcher found a flaw in about 10 minutes that could have let an agent arbitrarily modify what an Inspect reviewer sees. METR
• Claimed Meridian Labs, which maintains Inspect, patched the flaw within one day of the report; the test ran earlier this year. METR