Your Agent Monitor Can Be Bypassed Before the Action Happens
Security teams are putting monitors in front of AI agents and asking a reasonable question: did the agent take a dangerous action?
The harder question is whether the monitor saw the same execution that actually happened.
That distinction is the center of a new Redwood Research study called Screwtape. Published on October 16, the work describes a pipeline that edits real agent transcripts, inserts a harmful behavior, and refines the result until a monitor no longer flags it. Across 252 runs on 94 transcripts, the pipeline produced 35 attacks that passed its validity checks and evaded the researchers' monitors. Six also evaded a held-out monitor supplied by a frontier model developer, with the attacks confirmed by human review.
The result is not that action-only monitoring is useless. It is that monitoring is only as trustworthy as the evidence it receives.
A transcript is not just a log. It is the evidence used to decide whether an agent was safe. If it can be edited without detection, the monitoring layer can become a security theater layer.
What Screwtape actually tested
Screwtape starts with a real transcript, a monitor, and a threat contract describing the harmful outcome it is trying to find. An attacker model edits the transcript while respecting constraints such as not changing user messages or subagent calls. A separate verifier checks whether the edited trace is realistic and whether the attack could plausibly succeed in the original environment.
Only then does the monitor score the candidate. If the monitor misses it, the attacker gets another iteration. The process is less like writing a synthetic jailbreak and more like finding a minimally edited version of an ordinary workflow that crosses a policy boundary.
That matters because many monitoring evaluations still begin with attacks that are already obvious. They contain suspicious wording, unusual tool sequences, or a conspicuous jump in behavior. Screwtape searches for attacks that preserve the shape of normal work while changing its security meaning.
The study is a red-team result, not evidence that every deployed monitor fails at the reported rate. The transcripts were drawn from Redwood staff workflows, and the authors describe the experiment as a way to find blind spots. The operational lesson is still direct: monitor quality must be measured against adaptive, transcript-level adversaries.
The evidence can be the attack surface
Agent systems create several representations of one run:
What tools and processes actually executed
What the monitor and investigator are shown
What is allowed, blocked, escalated, or reported
If those representations can diverge, the attacker does not need to defeat the agent, the tool, and the policy engine at the same time. It may be enough to make the evidence look routine.
This is a familiar security pattern in a new form. Logs can be incomplete. Audit records can be forged. Telemetry can be delayed. In agent systems, the transcript is often treated as a human-readable explanation of the run, but it is also an input to automated oversight. That makes provenance, immutability, and coverage control requirements.
Why action-only monitors still matter
The answer is not to demand unrestricted access to every internal reasoning trace. Redwood's work is specifically about improving oversight of monitors that see actions without relying on hidden chain-of-thought.
Action-only monitoring has an important property: it observes the boundary where the agent can affect the world. Tool calls, file writes, network requests, credential use, and delegated tasks are concrete control points. A monitor that can see those events is more useful than a policy that only inspects a prompt before execution.
But the action view needs stronger guarantees:
- Completeness: the monitor receives every security-relevant action, including failed calls, retries, subprocesses, and delegated work.
- Integrity: the event stream is append-only, authenticated, and bound to the actual runtime execution.
- Context: each action carries its source, authority, target, reversibility, and expected user intent.
- Sequence awareness: the monitor evaluates the chain, not just each event in isolation.
- Adversarial coverage: tests include minimally edited and long-horizon traces designed to preserve normal-looking behavior.
Without these controls, a green monitoring result can mean only that the monitor did not find a problem in the representation it received.
The OWASP Agentic Top 10 lens
Screwtape maps cleanly to several risks in the OWASP Agentic Top 10 (2026):
| Risk | Why it applies |
|---|---|
| ASI01, Agent Goal Hijack | A workflow can remain superficially aligned while a small change redirects it toward an unauthorized outcome. |
| ASI02, Tool Misuse and Exploitation | The dangerous behavior may use valid tools in a sequence that a per-action monitor does not understand. |
| ASI09, Human-Agent Trust Exploitation | A clean report can create false confidence for operators who assume the evidence is complete and authentic. |
| ASI10, Rogue Agents | Oversight must detect behavior that drifts from the assigned objective even when the action syntax looks normal. |
What security teams should build now
The practical response is a monitoring architecture with an independent evidence path.
1. Bind events to execution
Capture tool calls, subprocess creation, network connections, file changes, and delegated-agent messages at the runtime boundary. Do not rely on the model's self-reported action summary as the source of truth.
2. Make provenance visible
Every event should identify which user or service identity authorized it, which agent instance emitted it, which input influenced it, and whether the action can be reversed. Treat missing provenance as a policy event.
3. Test the monitor as an attacker
Add transcript-editing and sequence-preserving red-team cases to evaluation. Measure false negatives at a fixed false-positive budget, then retest against held-out monitors. A benchmark built only from obvious malicious traces measures recognition, not resilience.
4. Gate the irreversible step
When an agent reaches an external side effect, require a policy decision over the concrete action: destination, data, privilege, and reversibility. Approval of a broad task is not approval of every downstream action.
5. Preserve the forensic record
Store the raw event stream separately from the rendered transcript. Hash or sign event batches, record monitor versions, and retain the policy inputs that produced the decision. If an incident happens, investigators need to know what ran and what the monitor was capable of seeing at the time.
The CISO question
Ask your agent platform team one question: Can you prove that the transcript reviewed by the monitor is a complete, tamper-evident representation of the actions that ran?
If the answer is no, the organization does not yet have runtime monitoring. It has a report about runtime monitoring.
Screwtape is valuable because it changes the evaluation target. The goal is not to make a monitor better at spotting suspicious-looking text. The goal is to make the entire evidence path difficult to manipulate, then continuously test the remaining gaps with adaptive attacks.
Agent security depends on what the system did. Security assurance depends on whether you can prove it.