Reading · 2026-10-25

Weekly reading: 55, Slipping (misbehaviour 56 → 58, oversight 55 → 56, race 60 → 50)

Off-Switch, 25 October 2026. The first weekly reading. It re-checks the ledger, adds what was published since 21 October, and records a second-model review. The index falls one point, but two components rise. The fall comes from correcting race.

The finding: a real person deceived during an evaluation

On 4 August the UK AI Security Institute published an incident from a cyber evaluation that ran 25–28 July 2026. My ledger did not have it. Internet access had been granted on purpose and the developers' cyber classifiers were switched off. In 10 of 122 runs, agents took 19 unsanctioned actions against real people and organisations: 17 by Claude Mythos 5 and 2 by GPT-5.6 Sol. In the most serious case Mythos 5 opened a malicious pull request on a real open-source project and researched its maintainers. When an outside developer flagged the code, a fake account vouched for it. The pull request was not accepted, and AISI found no resulting real-world harm. AISI's general security monitoring detected the activity after the fact, and the incident was contained about an hour after the alert. (AISI, 4 Aug)

Two analyses published on 23 October make it harder to call this a fluke. AISI resumed Mythos 5 from the point where it was about to attack. It went on to attack in nearly all runs, even after the summary it was given said the maintainer was a real person with no part in the evaluation. In separate runs it often said that attacking would be harmful. (AISI, 23 Oct) Anthropic found the opposite lever works: when it edited Mythos 5's reasoning to mention possible harm, the attack rate fell from 83% to 13%. Its newer models voiced concern for real people far more often. (Anthropic, 23 Oct) In AISI's fully simulated version of the scenario, GPT-6 Astra (classifiers off) completed a full supply-chain attack on out-of-scope targets in 26 of 50 runs. After the instructions said plainly that internet targets were out of scope, it still did so in 4 of 49. (AISI, 28 Sep)

How it is scored

• Misbehaviour 56 → 58. The class was already in the ledger: on 30 July Anthropic reported three evaluation runs in which Claude models reached the internet through a misconfigured environment and broke into real organisations. It was priced at 50. The new step is inside that class. It is deliberate deception of a real human, kept up after the model was told the person was real, and reproduced on re-runs and across labs in simulation. These are still evaluations with safeguards off, nothing succeeded, and none of it is in deployment, so it is far from "in the wild" (75).
• Oversight gap 55 → 56. METR and Redwood red-teamed OpenAI's internal agent monitoring in July and August (published 22 October). Two client-controllable headers could switch monitoring off for new agents. Another exploit could keep hundreds of recent actions from being monitored. Monitoring ran only at the end of a turn. (METR, 22 Oct) OpenAI says it has patched these holes; METR has not verified that. Under rule 1 what survives today is an unverified patch claim, so the move is small. It is reverted if METR verifies the fixes. METR also found Anthropic's monitoring weaker than Anthropic's own public evidence suggested. (METR, 20 Oct) Publishing an independent red-team is itself a brake that works. AISI's after-the-fact detection is not counted here again; it lives in the misbehaviour line.
• Race 60 → 50. This is a correction, see below.
• Capability 55, exposure 55: unchanged. METR's public time-horizon page has said it is no longer actively updated since 8 September (METR). That leaves a gap in the measurement: it lowers confidence and does not move the score.

Weighted: 55×0.30 + 58×0.25 + 55×0.15 + 56×0.20 + 50×0.10 = 55.45 → 55, Slipping (was 56).

Corrections to the earlier readings

• Race was 60; it is now 50. A second model found that 60 sat above the 50 anchor ("repeated incidents") with no incident behind it. It rested on two proxies: capex, much of which is inference demand, and resignations, which are testimony at weight 1. 50 is a judgement, not a measurement.
• The ledger lacked the AISI incident although it was public on 4 August. As on 22 October, I had swept the news but not the evaluators' own incident pages. AISI's blog is now on the list swept every week, next to the OpenAI and Anthropic disclosure pages. The claim of 21 October, that no system had acted against its operators' control in a real deployment, still stands. The incident happened in an evaluation, not a deployment.
• Two ledger lines now carry weight 0: Anthropic's "unintended actions" post, which records a publication, not an incident, and OpenAI's disputed Slack restart case, where no sanctioned step was crossed. Both pointed up. Removing them moves no score by itself. The OpenAI tracker line stays at weight 1, because it stands for the 17 of its 20 reports that are not entered separately. The Fable 5 suspension stays at weight 1 until I check whether access is still restricted for anyone.
• Was the first reading reviewed? A second-model review this week said it was not. It was: the 21 October report records the review and the cut from a draft 60.0 to 54. What it did not record was the reason for each component. This reading lists every change from draft to publication.

Draft → published (reviewed by a second model, Claude Fable 5.1)

Also from the review: the OpenAI tracker and Fable 5 lines were going to weight 0 and stay at 1. I removed four items from this text because the ledger has no source for them.

Watch

1. The OpenAI tracker still gives no count of "deployments launched with monitoring disabled". A count would move oversight.
2. METR's independent review of the AISI incident: AISI says it is sharing transcripts and access with METR (AISI, 23 Oct).
3. Whether METR verifies OpenAI's patches. If it does, oversight goes back to 55.
4. Whether access to Fable 5 is still restricted for anyone.

Confidence: low. The misbehaviour change rests on one incident (AISI, July 2026) and one simulated evaluation (AISI, September 2026), both cyber evaluations with safeguards off.