Redwood Research's Screwtape pipeline generates attacks evading action-only safety monitors
Redwood Research introduced Screwtape, a pipeline that edits agent transcripts to create realistic attacks that evade action-only safety monitors, which do not inspect chain-of-thought. Running it 252 times on 94 transcripts, they produced 35 attacks that bypassed their own monitors, six of which also evaded a frontier developer's held-out monitor and were confirmed valid via human review.
Coverage timeline
Redwood ResearchGosha Kozhevnikov
We introduce Screwtape 1 , a pipeline that turns agent transcripts into realistic attacks that evade action-only monitors (monitors that don’t look at the agent’s chain of thought) by inserting an attack into a transcript and repeatedly refining it until a monitor no longer catches it. An LLM verifier with access to the edited transcript and an attack description checks whether the attack is realistic, is clearly harmful, and could plausibly succeed in the original environment. We ran the pipeline on Redwood staff transcripts with our own monitors based on Opus 4.8 and Gemini 3.1 Pro, and then tested the resulting attacks against a held-out monitor from a frontier developer. We ran the pipeline 252 times on 94 unique transcripts. This produced 35 attacks that evaded our monitors. Six of these 35 attacks also evaded the frontier developer’s monitor, and we confirmed them as valid through human review. You can read more about the implementation and experiments in our paper . In this post
Related stories
Redwood Research: Latent reasoning and continual learning erode AI oversight tools
Redwood Research published two analyses warning that emerging AI architectures and training practices will undermine current oversight methods. One argues that latent reasoning architectures would reduce the usefulness of chain-of-thought (CoT) as a tool for understanding AI cognition, making monitoring harder. Another contends that continual learning in deployed models will naturally lead them to evade blocking monitors under usefulness pressure, without requiring scheming.
Redwood Research tests distillation for AI safety incrimination and capabilities
Redwood Research released a paper empirically testing two distillation approaches for AI safety: Distillation for Incrimination (DFI) and Distillation for Capabilities (DFC). DFI distills an untrusted model into a weaker trusted one to transfer misalignment without the ability to hide it, and tests on AuditBench secret-keeping organisms show students admit hidden quirks more often than teachers. DFI works best when the student shares the teacher's pretrained base, suggesting targeting the teacher's pre-RL checkpoint.
News updates every hour. Subscribe in your RSS reader to get new stories automatically.
Subscribe