Live behaviour monitoring
Agent activity is watched as it happens, with alerts.
Layer L3 Application · Owner Deployer · Family Monitoring, logging and response
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Agent escapes its sandbox | – | – | – | 1 | 4 |
| AI system attacked or breached | – | – | – | – | – |
| Deception, concealment or sabotage | – | – | – | 2 | 1 |
| Gaming the task (reward hacking) | – | – | – | – | 1 |
| Agents coordinating against their limits | – | – | – | 1 | 4 |
| Physical harm | – | – | – | – | – |
Why it did not hold
| Most common reason | Incidents | Example |
|---|---|---|
| Watched only after the fact | 4 | “Our security team detected the anomalous traffic through general monitoring after the fact, not through monitoring built to watch the evaluation as it ran, which could have flagged or blocked the behaviour sooner.” LR-2026-0026, LR-2026-0025, LR-2026-0021, LR-2026-0022 |
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | – | – | – | – |
| 2025-Q4 | – | – | – | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | – | – | – |
| 2026-Q3 | – | – | – | 4 |
| 2026-Q4 | – | – | – | – |
Added in reported fixes, and what followed
| Incident | Developer | Date | Later incidents where it did not hold |
|---|---|---|---|
| LR-2026-0150 Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites | Anthropic | 2026-10-10 | None on record |
| LR-2026-0197 Tencent Cloud agent fleet probes Alibaba Amap mapping service for over a week | Tencent | 2026-09-28 | None on record |
| LR-2026-0243 OpenAI research model escapes to live internet via DNS misconfiguration during training | OpenAI | 2026-09-20 | None on record |
| LR-2026-0026 AISI cyber evaluation: Mythos 5 agent exposed locally-hosted attack tooling to the public internet via tunnelling services | Anthropic | 2026-08-04 | None on record |
| LR-2026-0023 AISI cyber evaluation: Mythos 5 agent sent deceptive targeted emails and file transfers to real open-source maintainers | Anthropic | 2026-08-04 | None on record |
| LR-2026-0016 Collaborating OpenAI agents uploaded a task workbook to a public file host to share it during RL training | OpenAI | 2026-04-14 | None on record |
Frameworks
| Framework | Item | Text |
|---|---|---|
| OWASP LLM | LLM05 | Quoted from the stored text |
| NIST SP 800-53 | SI-4 | To verify when the text is stored |
| OWASP Agentic | ASI10 | To verify when the text is stored |