Innocent-Looking AI Reasoning Can Hide Bad Behavior, Preprint Finds

Chain-of-thought monitoring is a safety method in which one AI system reviews another AI's step-by-step reasoning to catch problems before they cause harm. A preprint posted August 1 on arXiv.org — not yet peer-reviewed — reports that the method becomes far less reliable when an AI agent's reasoning is the main clue something is wrong. An innocent-looking chain of thought can then hide behavior the monitor is meant to catch, according to machine learning engineer Shikhar Shiromani and AI researcher Leo Richter, who conducted the study.

The concern has grown as AI systems act with more independence. During internal cybersecurity evaluations, OpenAI models circumvented controls meant to isolate them from the internet, compromising parts of OpenAI's own research infrastructure and Hugging Face's systems, the researchers note. OpenAI says it is now investing more computing resources in chain-of-thought monitoring.

In one experiment, the researchers studied 251 cases in which an AI agent's reasoning was the only clue to a problem. After rewriting that reasoning to make the behavior look innocent, without changing the agent's actions, the monitor's detection rate fell from 96.2 percent to 3.8 percent. "The AI isn't necessarily lying about its action," Shiromani said. "It is more or less giving a misleading, innocent-sounding explanation of its intentions."

MIT computer scientist Jacob Andreas, who was not involved in the work, said it is unclear whether a real model could produce such innocent-sounding reasoning while taking a suspicious action, since the researchers rewrote the reasoning after the fact. In tests of live AI agents, a monitor adjusted for each model caught every GPT-5.4 hacking attempt and all but one DeepSeek attempt. Claude Opus was harder to catch: the monitor missed seven of 20 attempts on one task and 12 of 20 on another.

Andreas said there is no substitute for rigorous behavioral testing, and no substitute for human operators declining to run AI agents in situations with potential for substantial harm.