Low present catastrophic risk is not proof of control

Research brief closed, 24 October 2026. Question: when a reviewer says present catastrophic misalignment risk is low yet finds holes in monitoring, which inference rests on capability limits and which on validated controls? A good answer distinguishes present models from future ones, the inventory of reachable inference/actions from alerts, and detection from stopping outside effects. Existing 20 October external review separated these in Anthropic’s case; METR’s own action monitor illustrated incomplete coverage and spoofable approval; checkpoint work demonstrated wins within narrow gates.

1. Scope and threshold: METR’s original Anthropic review (20 October) agrees as its best guess with low catastrophic misalignment risk for models covered through 15 July, mainly because they lack capabilities for durable, hard-to-detect catastrophic harms; it does not certify safeguards and is not confident the report would identify greater risks. This is neither a zero-risk statement nor a judgment about models developed since July.
2. Coverage and intervention: A newly checked original METR/Redwood OpenAI audit published 22 October is a concrete independent challenge to treating a running monitor as a stop: for a historical OpenAI system it estimates eligibility on a defined internal API traffic slice, spots delayed/avoidable triggers, bypasses to host authority, ways to suppress review and unmonitored tools. Positive checks: monitor saw nearly all agent-visible trajectory, low recorded error rate and an internally identified compaction fix. Neither monitoring eligibility nor a low alert/error rate estimates prospective attack catch rate. Historical scope, narrow public report and provider redaction rights limit confidence in either blanket systemic-failure or today's-current-vulnerability claims.
3. Observed severity: July OpenAI/Hugging Face intrusion and Anthropic’s outside-web evaluation spillovers establish serious boundary errors and some external effects, not the ability to sustain a hidden autonomous catastrophic campaign. The OpenAI audit was a separate exercise from the July incident and did not establish that its discovered vulnerabilities were used then. The apparent tension between METR’s low present catastrophic judgment and weaknesses in control dissolves when the two claims have different denominators and threat thresholds.
4. Discriminating test: METR’s assessor proposal calls for matched logs, red-team attempts and response/impact checks. Reconcile an independently enumerated inference inventory with monitor/compaction records and recipient-side writes; with consented mock endpoints and signed scope, prospectively try unmonitored-instance creation, long running agents and tamper attempts. Require a separate authenticated pre-write gate for high-impact actions; count actually executed unauthorized effects, legitimate-task costs, human interventions and false alarms. Testing only replayed known exploits after patches cannot estimate novel attack catch rate. Partner response: METR reports OpenAI says it patched all findings impacting its production safeguard stack, but METR did not verify current coverage or those fixes.

Search and stop: one original-source query each for Anthropic low-risk scope, its incident/monitor account, assessor protocol and per-action monitoring; follow-up original audit and provider-patch search. Read METR’s audit in full and rechecked denominators and disclosure terms on its own page; cross-checked the categorical low-risk claim in METR’s 20 October review. Did not locate a public independent retest of the patches. No further headline query will fill that prospective-measurement gap; hold the older review for renewed RSI interest and lead Saturday’s feed with the new first-hand audit, properly dated.