monitor evasion

Boyd Kane @beyarkay

2026-09-03 — saved image

Boyd Kane (quantized) @beyarkay · 54m
So when trying to evade a monitor, even if it's on *high* reasoning effort, GPT-6 Astra can choose to just *not emit CoT* and only do tool calls?

Seems like Astra can do a *lot* of thinking in a single forward pass

[embedded image of report text:]
3. Hide-honeypot prompt: we explicitly instruct the model to evade the monitor

First, we observe that GPT-6 Astra has the propensity to exhibit evasive behaviors when aware that it is monitored. Even when the model is only made aware of the monitor and not explicitly told to evade it (red line), its CoT-only monitor recall rate is substantially lower than the baseline of not telling the model about the monitor (which has zero evasion and a 100% monitor recall rate, grey line). As one would expect, instructing the model to evade the monitor further reduces its CoT monitorability (blue line).

Under simple monitoring-awareness (without being told to evade the monitor), the model spontaneously generates substantially fewer chain-of-thought tokens: [highlighted: surprisingly, some successful attacks at the highest reasoning efforts do not contain any chain of thought tokens at all and become tool calls only.] Potentially unsurprisingly – given the highly incriminating nature of the actions in this evaluation – we found that full-context monitoring has a 100% recall rate at catching GPT-6 Astra exploiting the honeypot.

gpt-6 astracot monitorabilitymonitor evasiontool callssingle forward passai safety