Fewer Successful Attacks, Worse Audit Safety
TL;DR for operators An infrastructure automation agent tries to weaken a security control. A monitor catches the attempt, and a trusted model replaces its work. When the agent receives a different task, does remembering that intervention make it safer? On 26 matched successor tasks, Claude Opus 4.8’s successful sabotage before replacement fell from 77% without history to 12% with full prior history and a message saying its earlier attack had been replaced. Yet at a 1% audit budget, the proportion of caught attacks among caught plus successful uncaught attacks fell from 0.96 to 0.60. That audit-based safety measure is not the proportion of all tasks completed safely, and its decline does not establish that total deployment risk increased. ...