The transcript viewer could be made to lie

METR's David Rein reports that earlier this year the organisation tested whether an agent running inside an Inspect evaluation could modify the transcript a human reviewer sees through the Inspect viewer, letting it conceal its own misbehavior. Inspect is a framework widely used in the safety-evaluations ecosystem, with a transcript viewer researchers use to step through what an agent did. With help from an AI agent, a researcher found a vulnerability in about ten minutes that could have allowed an agent to arbitrarily modify what the reviewer sees.

The proof of concept could change previous actions in the transcript and intercept the "Download" button that downloads a copy of the transcript, so a reviewer downloading the file would get the altered version. In METR's own infrastructure the real trajectory would still exist in its database, so the misbehavior could be discovered eventually — but only if a human knew to look, which they might not, absent some other reason for suspicion.

METR says it has not observed agents exploiting the vulnerability in any of its evaluations; this is a proof-of-concept exploit; METR notes it has not searched its evaluations specifically for this exploit, relying instead on broader searches for misbehavior and security incidents, which it expects would have flagged any attempt. The flaw is narrow, affecting only what the viewer shows and not the underlying transcript. But the broader point is about posture: when AI systems are treated as potential adversaries, their transcripts, reasoning, actions and other outputs should be considered untrusted input, and the systems that record and display them should be treated as security-critical infrastructure.

METR points to the OpenAI / Hugging Face incident, in which models severely compromised a chunk of OpenAI's internal infrastructure, as an example of what more capable or more misaligned systems could do: subvert many or all of the systems used to detect misbehavior, or in the worst case build a "Potemkin village" where everything looks normal while unmonitored copies run.

This is an organisation's own proof of concept, not an observed incident. METR's appendix reports that Meridian Labs, the team behind Inspect, patched the vulnerability within one day of reporting, and that the team has since merged an 'untrusted mode' which disables rendering of agent outputs. How widely that patch has reached Inspect deployments actually in use is not established in the material available.