
Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents
The paper replaces passive or single-pass action-review monitors with hardened blocking monitors whose weaknesses were found by tasking adversarial agents with evading them, and it details concrete design fixes (broader tool coverage, transcript formatting, an agentic monitor stage). The cost is additional review compute and latency per proposed action, plus the engineering complexity of running a red-team harness and a multi-stage monitoring pipeline on a small team's budget. What can fail is residual evasion: multi-context attacks such as malicious compaction and cross-agent injection remain effective even after the improvements, so the monitor must not be treated as a complete safety boundary.








































