Step 10: tool results

{
  "url": "https://arxiv.org/abs/2510.09462",
  "title": "Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols",
  "stance": "affirms",
  "context": "Introduction of an ICLR 2026 paper testing adaptive prompt-injection attacks by a stronger untrusted model against weaker trusted monitors on APPS Backdooring and BashBench.",
  "speaker": "Mikhail Terekhov et al.",
  "claim_id": "03360fe8-6d07-4c01-b5f4-fc1892a910fc",
  "source_date": "2026-03-02",
  "source_kind": "preprint",
  "verbatim_text": "When the attacker-monitor capability gap (Panfilov et al., 2025) is sufficiently large (e.g., GPT-5 vs. GPT-4o-mini), the untrusted model can effortlessly invent working prompt injections on the spot (see Section 3.4). Our results demonstrate that simple prompt injections can fully subvert existing protocols that rely on a monitor."
}

{
  "url": "https://arxiv.org/abs/2508.19461",
  "title": "Reliable Weak-to-Strong Monitoring of LLM Agents",
  "stance": "affirms",
  "context": "Monitor red-teaming study using evasion strategies including prompt injection on SHADE-Arena and CUA-SHADE-Arena; it also reports that a hybrid scaffolding lets weaker monitors reliably monitor stronger agents, a partial counterweight.",
  "speaker": "Neil Kale et al.",
  "claim_id": "03360fe8-6d07-4c01-b5f4-fc1892a910fc",
  "confidence": 0.7,
  "source_date": "2025-08-26",
  "source_kind": "preprint",
  "verbatim_text": "First, agent awareness dominates monitor awareness: an agent's knowledge that it is being monitored substantially degrades the monitor's reliability. ... Our work establishes a standard workflow for MRT, highlighting the lack of adversarial robustness for LLMs and humans when monitoring and detecting agent misbehavior."
}

{
  "kind": "related",
  "claim_id": "03360fe8-6d07-4c01-b5f4-fc1892a910fc",
  "reasoning": "Near-identical formulation resting on the same evidence (Terekhov et al.); this one turns on the capability gap between agent and monitor, the other on the model's awareness of the monitor and on whole protocols. A merge case is before the Curator; the link stands meanwhile.",
  "other_claim_id": "4c2cc0db-a4cc-434e-a72f-21adc0285d07"
}