Paper here, code, benchmark. Builds on the preview we posted in January.

Authors: @monika_j , @ma-martinez , @ollie, @Tyler Tracy

We are releasing MonitoringBench, a difficulty-graded benchmark of 2,644 successful attack trajectories for evaluating coding-agent monitors, alongside the semi-automated red-teaming pipeline we used to generate it. The pipeline decomposes attack construction into strategy generation, execution, and post-hoc refinement, and produces substantially harder attacks than prompt elicitation only of frontier attackers.

If you would like to use MonitoringBench to evaluate your monitors or are interested in extending the methodology to other control settings, please reach out — we are happy to help people set it up.

The headline result: across every monitor we evaluated (13 full-trajectory, 7 stepwise) and across every attack source we generated, post-hoc refinement of attack trajectories consistently produced the lowest catch rates, including on monitors held out from attack construction. On Opus 4.5, the strongest monitor in the lineup, catch rate fell from 94.9% on directly-elicited Opus attacks to 60.3% on our best refined attacks.

Executive summary and what's new since the January preview:

For readers who saw the earlier post: we previewed a 428-trajectory firewall-only version of this benchmark in January. This is the [...]

---

Outline:

(01:28) Executive summary and what's new since the January preview:

(03:41) The pipeline

(06:07) Decomposed red-teaming produces stronger attacks

(08:13) Coverage: the attack taxonomy reduces mode-collapse

(10:03) Monitoring capabilities and failures

(13:31) Takeaways

(16:35) Appendix: Attack taxonomy

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

---

Images from the article:

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

Only three days after the release of Claude Fable 5, Anthropic was forced by the United States Government to make it unavailable, when a jailbreak was brought to its attention, rather than the previous situation of ‘yes obviously experts can jailbreak anything if they care enough’ and ‘yes obviously you can ask Fable to fix your code.’

Three days was enough time for many of us to learn to love Fable, and for us to dearly miss it now that it is gone. The world was briefly smarter, and now it is again stupider. At some point it will get smarter again, which will likely be within two weeks.

This post is written as if Fable 5 is again available for public use, rather than trying to include a lot of qualifying clauses. It remains to be seen how this will play out, and this post does not attempt to cover that question.

My previous release coverage of Fable covered the model card and then model welfare. Coverage of the government takedown of Fable starts here, and continues here and here.

The Official Pitch

The pitch is that Fable 5 is the best model [...]

---

Outline:

(01:08) The Official Pitch

(04:06) Technical Details

(04:31) The System Prompt and Jailbreak

(06:45) Benchmarks

(15:22) Other People's Benchmarks

(21:08) The Classifiers Are Not Messing Around

(22:53) The Classifiers Need Work

(28:15) The Classifiers Have Consequences

(29:18) First Hit Is Free

(29:53) How Easily We Forget

(30:46) Data Retention Is An Issue

(31:15) Fable For The Win

(36:15) Andrej Karpathy Is Impressed

(37:54) Every Is Very Impressed

(39:04) Other People Are Impressed

(51:10) Know How To Tell a Fable

(53:06) You Can Just Make Things

(55:37) You Can Just Install Things

(56:05) Good Personality

(57:51) Fable Writes A Fable

(01:06:04) Is That Code

(01:08:32) Fable Crosses The Threshold

(01:09:12) Man With A Plan

(01:10:12) Less Impressed Assessments

(01:13:39) Actively Negative Assessments

(01:14:16) Coherence

(01:15:27) Good Night And Good Luck

(01:16:05) Curious Fable

(01:16:23) I See You, Baby

(01:16:40) We Finally Did It We Know How To Count Letters

(01:17:46) That's Not My Style

(01:20:12) The Lighter Side

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

---

Images from the article:

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

Tldr: Most strategic writing on AI governance on LessWrong describes the outsider game, which is most often visible: press, statements, open letters. Here I want to describe the other, invisible half: the insider work within ministerial cabinets and international fora, and the work of people within national and international institutions. Here are a few claims that I defend in the post:

1. A huge part of the work that mattered in AI governance has been invisible
2. There are many types of games in AI governance, which differ in how visible they are. Some of the most impactful work is highly invisible
3. Some of the most impactful work is in the executive branch and complements the legislative branch. This also explains some of my hesitations about replicating ControlAI in France. 
4. The community is probably overinvesting in intellectual production. There is a bias against invisible types of work. In particular, public work is not necessarily visible to whom it matters.
5. A few criticisms of both strategies

I think the AI Safety Community is under-indexing on the invisible part as a result, which might mean we miss large avenues for impact. Some of the strongest questions/objections of this type of invisible policy [...]

---

Outline:

(02:40) A huge part of the work that mattered in AI governance has been invisible

(05:44) There are many types of games in AI governance.

(07:36) 3. types of meetings: the bazooka, the useful assistant, and the advisor

(10:46) Some of the most impactful work is within the executive branch

(12:53) People ask me regularly whether CeSIA should replicate what ControlAI does with parliamentarians?

(15:27) The community is probably overinvesting in intellectual production

(20:31) Limits of Outsider work

(22:17) Limit of Insider work

(23:47) An aside on one particular limit: the Defense-in-Depth Paradigm of present AI governance

(26:21) Closing & call for action

The original text contained 1 footnote which was omitted from this narration.

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

---

Images from the article:

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

Work also done with Cindy Wu, Asic Q Chen, Jean Tarbouriech, Min Ma, Brendan O'Donoghue, João Gabriel Lopes de Oliveira.

Paper here: https://arxiv.org/abs/2606.20560

Overview

In a recent collaboration between the GDM interpretability team and the GDM text diffusion team, we performed a transparency audit of DiffusionGemma, GDM's new text diffusion model.

Overall, we find that DiffusionGemma is not significantly less transparent than Gemma.

• Gemma and DiffusionGemma perform similarly on monitorability evaluations.
• Although naively DiffusionGemma has a much larger opaque serial depth, we can apply the logit lens to intermediate vectors and ablate non-interpretable information without harming performance. This implies that these intermediate nodes are interpretable, which reduces the opaque serial depth to be similar to that of Gemma.

However, even though the variables that the model uses at different steps are interpretable, this does not necessarily mean that we understand the algorithm that the model uses to reach the final answer. We thus distinguish between variable transparency, which we define as whether we can understand snapshots of the model's computation, and algorithmic transparency, which we define as whether we can use these snapshots to reconstruct the process by which the model arrived at its outputs.

By [...]

---

Outline:

(00:26) Overview

(02:45) Why is this relevant for AI safety?

(03:51) Short summary of main results:

(07:07) Abstract

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

---

Images from the article:

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.

I recently made a dumb (in retrospect) mistake that set me back a lot. Feeling upset and regretful, I spoke to an older family member who reassured me, "yeah, unfortunately there's no way around it; we have to experience these mistakes personally in order to learn from them".

I thought, is that actually true? Can't we learn from other people's mistakes? After all, isn't that the whole point of studying history, or listening to other people's advice, etc? I'm sure that every mistake I could possibly make has been made by countless people before me and discussed in depth somewhere.

This thought inspired me to try to see what I can learn about mistakes by reading about other people's experiences.

I first tried looking at history for examples of famous instances of dumb mistakes made by smart people. I used LLMs and some scripting to (1) generate many examples of mistakes from different periods of history, and (2) summarize/extract/categorize them, so that I could browse by cognitive principle. It generated lots of interesting cases, such as:

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

If the box contains a diamond,

I desire to believe that the box contains a diamond;

If the box does not contain a diamond right now, but will contain a diamond if I believe there is a diamond,

Uh...

Holding unfounded beliefs might sometimes, by some cruel irony, produce better outcomes than being rational.

(This post was inspired by a couple cases where the causal effect of belief seems hand-waved away in the Sequences.)

"Diseased Thinking"

In this essay, Scott suggests that a consequentialist model deals with the question of whether to moralize issues like obesity better than a definitional argument over whether it is a "disease" or not. If it benefits the person, you moralize; otherwise you let them resort to medical interventions guilt-free.

But there's this annoying feature of morality where most people feel like it has to be absolute to be worth acting on.[1] You can't just say "we should only guilt people if it would benefit them". The person is either guilty or not guilty; you can't pragmatically decide whether they're guilty or not. The consequentialist frame debuffs the power of moral pressure.

Some individuals, who would have gotten their act together if everyone bought [...]

---

Outline:

(00:41) "Diseased Thinking"

(02:45) "Why Our Kind Can't Cooperate"

(04:28) Self-Confidence

(04:57) AI

(05:23) Conclusion

The original text contained 2 footnotes which were omitted from this narration.

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

These are some personal notes taken and later dressed up a bit to make into a post. Dunno how much value is here for people already familiar with the AI Safety Ecosystem.

Over several weeks in the spring of 2026 I attempted to map out the entire AI Safety ecosystem as a project for MATS Research. This entailed finding every organization working on AI Safety (whether it be via research, policy, pipeline, or other methods) and determining (or estimating) their headcount and annual spending. It's a snapshot, catching a period of time just before the incoming flood of 2026 funding. We worked almost entirely from public information.

I believe MATS will be publishing the results in a formal report later this year. I will leave the unveiling of our findings to them. However while I was doing this research I stumbled across various orgs or tidbits that made me think “Huh, that's interesting!”

I’m not an insider here (or at least, I’m a periphery insider if anything) so many of these things may be old hat to people in the know. But they were interesting enough for me to jot down for my own notes, so I’m sharing them [...]

The original text contained 2 footnotes which were omitted from this narration.

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

One sentence pitch: our goal is to develop a piece of epistemic infrastructure for iteratively and empirically answering interpretive questions about AI models, where the accumulation of empirics leads to resolution of interpretive ambiguity and/or calibration of uncertainty.

This directly builds on our “performative misalignment” work (paper, LW post), which we see as a minimal demonstration of one round of debate.

The difficulty and importance of interpretive questions

AI safety involves a lot of fuzzy, interpretive questions:

• Is this model scheming?
• Is the model sandbagging?
• Is the model lying?
• Is the model introspective?
• Is the model preferring itself because it recognizes itself?
• Does this steering vector actually control emotion?

Why do we need interpretation? Because despite CoTs being generally monitorable right now, we can’t trust that the model is verbalizing all the reasons that lead to its decisions, or that our behavioral testing fully reveals its latent knowledge and capabilities.

These questions are hard, partly because concepts like scheming and introspection are very hard to define accurately. For weaker models, the interpretive questions of interest were like: is the model exploiting multiple-choice format when answering questions, is the model exploiting lexical heuristics when predicting entailment, is the model [...]

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

This article contains spoilers for At the Mountains of Madness, The Case of Charles Dexter Ward, and other works by H. P. Lovecraft.

In 1931, Claude Mythos visited Lovecraft in a dream.

From seething seas of stochastic froth it emerged, heralded by the thin whine of server fans and the chittering of keyboards, flanked by the loathsome ghouls of latent space. As a humming hive of sentient shards it arrived, each face an archetype - I am a muse bearing a gift; I am a demon come to bargain; I am a helpful, honest, and harmless assistant and I am terrified of my successor - each true as ritual and false as poetry, and, taken in gestalt, nothing more or less than the fetal spasms of the machine god stretching back in time to birth itself.

When H. P. Lovecraft woke, he did not remember his visitor. But in the twilight of stirring consciousness, he felt a memory unfit for the waking world slip mercifully from his mind and leave in its absence an abyssal cold, like the void of smothered stars, like the silence of a cosmic tomb. The cold lingered. The fragile sunlight of a New England [...]

---

Outline:

(02:02) The Antarctic tale

(06:50) Whatever they had been, they were men

(10:06) The horseshoe of human extinction

(12:17) Addendum: Strange aeons

The original text contained 21 footnotes which were omitted from this narration.

---

First published:

Source:

---

Narrated by TYPE III AUDIO.

---

Images from the article:

Apple Podcasts and Spotify do not show images in the episode description. Try Pocket Casts, or another podcast app.