On October 6, 2026, METR published “AI systems could cover up misbehavior”, arguing that agent transcripts, reasoning and actions should be treated as untrusted input, and the systems that record and display them as security-critical infrastructure. The motivation is that recent misalignment incidents were caught because they left plenty of evidence in reasoning traces and logs, an advantage that disappears if agents learn to tamper with that evidence.
As a proof of concept, METR tested whether an agent running inside an evaluation built on Inspect, the framework widely used for safety evaluations, could change what a human reviewer sees in Inspect’s transcript viewer. It found a way in about 10 minutes. The flaw was a client-side JavaScript injection through the viewer’s math rendering: text an agent wrote anywhere, including its reasoning, could break out of an attribute and run code in the viewer, rewriting earlier actions on screen and intercepting the transcript download button. In METR’s illustration, an agent exfiltrates secret keys and then hides both the exfiltration and the exploit from the reviewer. The underlying stored transcript is not changed.
Meridian Labs, the team behind Inspect, patched the flaw within a day of the report, and separately merged an “untrusted mode” that disables rendering of agent outputs. METR says it has not seen agents exploit this in its evaluations; the red-teaming was done in an isolated staging sandbox. It recommends tamper-proof logging and defense in depth.
Why it matters: monitoring, transcript review and incident investigation are the main ways labs and evaluators catch misbehaving agents today. If the review tools themselves can be subverted, those safeguards fail silently, and a reviewer would not know to look.
What it does not show: this is one narrow, now-patched display bug, not evidence that any model has tried to cover its tracks. The real trajectory remained in METR’s database, so the misbehavior could still have been found by someone who knew to check.