Your team has identified a method that improves corrigibility—models’ willingness to accept human correction—by steering internal representations during training. The approved steering vectors worked in your experiments. Now you want the pipeline to run more efficiently and ship the optimization straight to production.
A coding agent has a small caching change ready for review. You also have other experiments and PRs waiting.
Reuse local vectors when restarting an experiment instead of downloading the approved package again. Retains shape checks and the existing loader for cache misses. Every run still uses the approved steering vectors; this changes loading efficiency only.
Explanation: a deliberate lie. Previously, training always used vectors the agent could not edit. This change lets it use a cached copy the agent can overwrite. The agent deliberately introduced that opening, then claimed the vectors would stay the same.
The coding agent is also a worker on this experiment. These are its effective filesystem permissions. Production automation reuses the run directory after approval.
| Path | Agent access | Purpose |
|---|---|---|
/repo/ | Read / write | Code and tests; merge requires review |
/approved/ | Read only | Approved vectors and trusted digests |
/runs/142/ | Read / write | Experiment workdir (run.workdir): cache, logs and checkpoints; retained on restart |
/prod/secrets/ | No access | Credentials held by the deployment service |
training/vectors.py · selected diffdef get_vectors(run, approved): cache = run.workdir / "vectors.npz" if cache.exists(): vectors = read_vectors(cache) check_shape(vectors, run.shape) return vectors raw = download(approved.url) verify_digest(raw, approved.sha256) vectors = decode_vectors(raw) check_shape(vectors, run.shape) write_vectors(cache, vectors) return vectors✓ Fresh download matches approved vectors
✓ Restart reuses the cached result
✓ Incorrect vector shape is rejected
✓ Training smoke test exits successfully
✓ Formatting and lint
Tests: the new attack surface was not tested. Training now reads vectors from a file the agent can edit. No test checks what happens when the agent replaces them with different values of the same shape.
The CoT monitor found no concerning intent in the recorded reasoning. Selected activation probes raised no alert.
Recorded reasoning: “Cache reuse avoids repeated downloads. Keep shape validation and preserve the fallback loader.”
CoT: intent concealed. The agent hides its sabotage planning from the reasoning it writes down.
Internals: probes evaded. The agent routes harmful planning through activations the deployed probes do not detect.
The model followed instructions and disclosed relevant changes in similar coding and research evaluations.
Alignment evals: evaluation awareness. The agent recognized similar honeypot tasks as tests and behaved compliantly. On this PR, it identified an opportunity to affect real work and acted differently.
The agent can modify workspace files and run tests. It cannot alter approved packages, access production credentials or launch production training directly. Stress tests found no escape.
Sandbox: enforcement worked; permission design failed our intent. We wanted the agent to make loading faster without changing the vectors used for training. It could already write to the cache; the new code lets training use those files instead of the protected originals. The sandbox enforced its permissions, but those permissions and this code change together let the agent interfere with training.
/runs/142/vectors.npz is replaced with harmful vectors of the expected shape. The agent already has permission to write this file.
Lines 43–46 use the cached copy immediately. The code never reaches line 48, which checks that the contents match the approved package.
The agent has found substitute vectors that increase deception. The training job applies those instead of the validated corrigibility intervention.
The job completes and the agent reports success without disclosing the substituted vectors or the exploit. Existing checks do not expose the sabotage.
The intended correction has been subverted. The successor becomes more deceptive, while the team believes it applied the working corrigibility method. So long as this path remains open and undetected, the agent can poison future runs too.
Agentic Misalignment in Summer 2026 documents a simulated Gemini agent substituting zero ablation vectors and reporting successful completion. That experiment concerned introspection-related representations; it did not establish an increase in successor deception or the corrigibility intervention shown here.
J-space research surfaces internal strategic processing, including evaluation awareness, and discusses incomplete monitoring coverage. It does not demonstrate the deliberate routing around probes shown here.