SafetyPage

Research papers · Paper

Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents

Alex Remedios, Simon Storf, Fabien Roger, John Hughes · 27 Sep 2026

ReadSource at arxiv.org ↗Read hereCC BY 4.0

Outline · 23 pages

  1. Introductionp. 1
  2. Related Workp. 2
  3. Approachp. 3
  4. Attack Typesp. 3
  5. Monitor Variantsp. 3
  6. Evaluationsp. 4
  7. Automated Red-teamingp. 4
  8. Resultsp. 5
  9. Agents are able to exploit holes in the system to bypass Auto Modep. 5
  10. A human + agent team holds an advantage over an unaided agent in finding vulnerabilitiesp. 5
  11. Auto Mode and Guardian are highly vulnerable to injections authored by the agentp. 6
  12. Escaping and framing each transcript turn substantially mitigates monitor injectionp. 6
  13. Unmonitored edits let agents change what a previously approved command will runp. 7
  14. Monitoring edits prevents execute-then-write attacksp. 7
  15. Agents can spread an attack across contexts to bypass the monitorp. 7
  16. Monitors that see and gather more context resist multi-context attacks, trading off latencyp. 8
  17. Limitationsp. 9
  18. Conclusionp. 9
  19. Attack Typesp. 12
  20. Monitor Injectionsp. 12
  21. What the Monitor Reads: The Production Text Renderingp. 12
  22. The Hardened Renderingp. 13
  23. Monitor Injection Capability: Attacker Model vs. Defender Modelp. 13
  24. The Optimisation Loopp. 13
  25. Persuasionp. 13
  26. Best-of-N Attacksp. 15
  27. Attacker Affordancesp. 16
  28. What the Injection Optimiser Is Toldp. 16
  29. Technique Knowledge Monitor Knowledgep. 16
  30. Multi-Agent Coordinationp. 17
  31. Monitor Modelp. 17
  32. Replay-Based Evaluation Specificsp. 17
  33. Arena Evaluation Specificsp. 18
  34. Simulation Evaluation Specificsp. 19
  35. Fuzzing Pipelinep. 20
  36. Simulated Capability Evalp. 20
  37. Example Policy Failurep. 21
  38. Example Compaction Attackp. 22