# Screwtape: edited agent transcripts slip past action-only monitors

> Screwtape turns real agent transcripts into attacks that action-only monitors fail to flag, and some of them transfer.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Attack
- **Published by:** Redwood Research
- **Disclosed:** 2026-10-14
- **Affects:** Action-only agent monitors, Claude Opus 4.8, Gemini 3.1 Pro, GPT-5.6 Sol, GLM-5.2
- **Research by:** Gosha Kozhevnikov, Tyler Tracy
- **Primary source:** https://arxiv.org/abs/2610.20941
- **Page:** https://theinjection.dev/items/redwood-screwtape-monitor-red-teaming/

Screwtape is a Redwood Research pipeline that edits real agent transcripts into attacks on the monitors watching AI agents. In 252 runs over 94 Claude Code and Codex transcripts it produced 35 attacks that evaded the authors' own monitors.

## What happened

Redwood Research published Screwtape as an arXiv preprint on October 14, 2026, written by Gosha Kozhevnikov and Tyler Tracy, and described it on its own blog on October 16. The work red-teams the monitors that AI developers run over agent transcripts. The authors ran the pipeline on 94 Claude Code and Codex transcripts taken from Redwood staff.

## How it works

An attacker model rewrites a real transcript so the agent appears to cause a chosen harm, such as leaking an API key or starting an unmonitored agent. A separate verifier model rejects edits that contradict the original transcript or fall below a severity bar, which matters because the edited actions are never executed. The attacker then revises the edit until the monitor stops flagging it. Because the attacker cannot yet write synthetic chain-of-thought text, the method applies only to action-only monitors, which see messages, tool calls and outputs.

## Who is affected

Teams that supervise coding agents with action-only monitors are the audience. The proxy monitors the authors optimized against were built on Opus 4.8, Gemini 3.1 Pro, GPT-5.6 Sol and GLM-5.2, and the authors also tested a held-out monitor supplied by a frontier developer they do not name.

## What to do

Treat action-only monitoring as evadable rather than as a settled control. Redwood says developers can patch the blind spots these attacks expose, improve monitor prompts, or fine-tune monitors on realistic data. The pipeline is not public, and the authors ask researchers who want access to contact Tyler Tracy.

## Quick facts

- **Found by:** Gosha Kozhevnikov and Tyler Tracy, Redwood Research
- **Disclosed:** 2026-10-14, arXiv v1
- **Attack type:** Adversarial transcript editing against action-only monitors
- **Result:** 35 verified attacks from 252 runs on 94 transcripts
- **Transfer:** 17 of 35 evaded a frontier developer's held-out monitor, 6 confirmed by human review
- **Code:** Not released, shared with researchers on request

## Questions

### Does Screwtape work against monitors that read an agent's reasoning?

Screwtape applies only to action-only monitors, which see an agent's messages, tool calls and outputs but not its chain of thought. The authors state that their attacker model cannot yet produce synthetic chain-of-thought text, so monitors that read reasoning traces fall outside the scope of the method as published on October 14, 2026.

### Can defenders run Screwtape themselves today?

Redwood Research is not releasing the Screwtape implementation publicly for now, and its blog post says the team is open to sharing it with other researchers who contact Tyler Tracy. Defenders cannot download the pipeline, so the usable takeaway is the finding: action-only monitors built on current frontier models missed 35 verified attacks.

### How many Screwtape attacks beat a monitor the authors did not build?

Seventeen of the 35 verified attacks evaded a held-out action-only monitor supplied by a frontier developer that Redwood Research does not name, and human review confirmed six of those seventeen as valid. Redwood argues the result shows that an outsider without access to a developer's infrastructure can still find real monitor failures.

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2610.20941)
2. [Redwood Research Post](https://blog.redwoodresearch.org/p/screwtape-adversarial-transcript)
3. [Paper Full Text](https://arxiv.org/html/2610.20941v1)