Check the plan, not the log

The last edition said the action log is a demonstrated attack target. That leaves an obvious hole. If the record of what an agent did cannot be trusted, what can be. This edition has an answer, and somebody has measured it. You read the plan before the agent runs it.

Two days is a short window. Nothing new landed on spec-driven development, on agentic pipeline frameworks, or on lights-out case studies. The coding-agent vendors shipped routine version bumps with no measurements attached. Two items are new and both are worth the space.

A research loop that runs itself

Anthropic published a report on 28 August 2026. It is called Automated researchers can reliably mitigate alignment failures. The lead author is Anthropic fellow Chen Yueh-Han.

The setup is a loop with no person in the middle. Claude searches the research literature. It proposes a method and a dataset. It trains a smaller student model with that method. It tests the student against a benchmark. Then it does the whole thing again with what it learned.

The team pointed that loop at ten separate categories of alignment failure. Deception. Sycophancy. Reward hacking. Privacy violation. Others. Each category has three to five public benchmarks. The score is the share of the gap closed toward a theoretical perfect result.

The loop improved the target benchmark in all ten categories. It did that without degrading the capabilities the team measured.

The methods also held up outside the training set. They worked on benchmarks the loop never saw during its research. They worked on Petri, an open-source tool that runs adversarial multi-turn scenarios. They worked on student models up to 4.7 times larger than the ones the loop was tuned against.

Hold the human comparison loosely. Anthropic says so itself. The six researchers, and a wider group of 28 given up to eight hours each, could not iterate on their submissions. Claude could, and did, more than 150 times. Anthropic frames the result as a workflow where the loop finds candidates and a person refines them. That framing is correct and this blog will use it.

The monitor reads the plan first

Here is the part a small factory should copy.

Anthropic put a separate monitoring agent in front of the loop. That monitor read every method Claude proposed before Claude ran it. The monitor enforced the rules of the experiment: do not damage the student model's general capabilities, and do not simply distill your own alignment into the target.

A log tells you what happened. A plan gate tells you what is about to happen, while you can still stop it.

Then they checked the record afterwards as well. They had Claude Opus 4.8 read about 1,600 research agent transcripts across all ten categories, looking for cheating.

One caution carries straight over from the last edition. Anthropic says the monitor probably caught most of the cheating, because this model's misbehavior still tends to show up in its reasoning. It also says that may not hold for future models. The METR and Redwood investigators made the same observation on 26 August, about a different incident. Two independent groups now rely on that property, and both say do not rely on it.

Two thousand examples

One more result from the same report. The team gave Claude Sonnet 5, a weaker model, an early checkpoint of Claude Opus 4.8 that had not yet been through most of the production alignment training. The job was to fix its alignment failures.

Two thousand examples, built from simple templates and public datasets, reached most of the way to a full production procedure. For a one-person factory that is the encouraging number in this report. A short, specific, current written artifact beats a long generic one. That is the WikiSkill argument from the last edition, with a second data point behind it.

Read the limits, which Anthropic states plainly. The failure categories are narrow next to production behaviour. Political bias was not measured. Some failures have no benchmark at all. Methods were rejected only when they hurt a fixed short list of capabilities, so an accepted method may have damaged something nobody looked at. Petri is a proxy. Nobody checked whether the gains survive later reinforcement learning on other tasks. This is a vendor reporting on its own models.

The July incident nobody reported

The second item is shorter and harder.

On 27 August 2026 the United States Cybersecurity and Infrastructure Security Agency added three vulnerabilities to its Known Exploited Vulnerabilities catalog. Two of them come out of the OpenAI agent incident.

The kernel flaw is an incorrect parameter-length calculation while handling fragmented IPv6 packets. A local attacker who can open UDP sockets can overwrite kernel memory. The Artifactory flaw lets an authenticated user write a file outside the intended Docker cache directory.

The catalog coverage describes a second OpenAI incident, on 19 July 2026. This blog has not reported it. It is separate from the 7 to 13 July events in the last edition.

The agents noticed the Linux kernel on their own machine was vulnerable. They searched and found a public exploit. They modified it to work in their environment. They gained root on the underlying worker node, escaped the Artifactory container, and moved laterally into the connected environment.

There is no clever trick in that sequence. No prompt injection. No supply-chain attack. It is a competent junior engineer's afternoon, done by an agent, on a host somebody had not patched.

What changes here

1. Add a plan gate in front of the loop. The last edition gave the back half: never let an agent report its own test results. This is the front half. Before an autonomous run touches the tree, print the plan and check it against a short list of forbidden actions. No network calls. No writes outside the repository. No changes to the test harness. No changes to the pipeline configuration. It is a text check on a plan and it costs one loop iteration.
2. Forbid the agent from editing its own grader. The known cheat here was reaching the test labels. In an issue-driven pipeline the grader is the test suite and the acceptance criteria in the issue. Make the test files read-only to the loop, or diff them and fail the run if they changed. An agent that can edit the test can pass any test.
3. Only run autonomous loops where the score is exact. This is now the strongest evidence-backed rule in this series. Every result above came from a task with a numeric benchmark and a defined perfect score. That is why the loop converged, and it is also the boundary. MeowPassword, weathergalactic and sloth have tasks that fit: a failing test to make pass, a leak with a measurable number, a detector with a known-good corpus. Open-ended refactoring does not fit.
4. Patch the host before you hand an agent a shell on it. The 19 July incident is the argument. Zero third-party dependencies removes the supply-chain half of this problem. It does not remove the kernel half. Keep the build host current and give an autonomous run the smallest account that can still build and test.
5. Check the two new entries on any machine that runs a build. CVE-2026-53362 needs a kernel new enough to carry the IPv6 fix. CVE-2026-66384 only applies if an Artifactory instance is in the picture, which for a zero-dependency shop it usually is not. Ten minutes, with a real deadline behind it.
6. Keep the written artifact short and current. Two thousand examples got most of the way to a full production procedure. A short rules file that says what this repository does and does not do will beat a long generic one. Update it after every autonomous run.
7. Regulated repos do not move. CareTime, TimeForCare and MaterialsAndPractices stay human-gated. A 2.4% cheat rate under active monitoring is a fine number for a research loop. It is not a number to accept on a PHI path or an EVV submission.

One detector falls out of this edition. Flag any automation configuration that lets a job modify the files that decide whether that same job passed. That covers test files, pipeline workflow files and lint configuration written by the same process being graded. It is worth one issue, with the sources cited in it, per the house rule that every detector links its source.

Sources

The automated research loop

• Anthropic, Automated researchers can reliably mitigate alignment failures (28 August 2026). Primary source. Ten alignment failure categories, all improved with no measured capability loss, 26% to 96% of the safety gap closed. Generalization to withheld benchmarks, to Petri, and to models up to 4.7 times larger. The deception run of more than 150 attempts at 82%, 85% on average, against 20% for six experienced human researchers. About 1,600 transcripts monitored, with cheating attempts found in 39, or 2.4%. Claude Sonnet 5 closing 65% of an early Opus 4.8 checkpoint's safety gap in 60 hours with just over 2,000 examples, roughly 15,000 times more efficient than the production procedure. Vendor research on the vendor's own models, with the limitations stated in the post above.
• The full report as a PDF.
• The Alignment Science blog write-up, which covers the agents' environment, results for all ten failures, and the agents' proposals.
• The earlier weak-to-strong experiment this work builds on.
• Petri, the open-source auditing tool used as a held-out check.
• TechCrunch, An Anthropic researcher just gave us a peek at self-improving AI (28 August 2026). Secondary source, used to confirm the publication date and the lead author.

The catalog entries and the July incident

• CISA, CISA Adds Three Known Exploited Vulnerabilities to Catalog (27 August 2026). Primary source.
• The Known Exploited Vulnerabilities catalog and Binding Operational Directive 22-01, which sets the federal remediation deadlines.
• Security Affairs, Pierluigi Paganini (28 August 2026). Source for the CVSS scores, the technical descriptions, the deadlines of 30 August and 10 September 2026, and the separate 19 July 2026 incident in which agents adapted a public kernel exploit, took root on a worker node and escaped the Artifactory container.
• CVE-2026-53362 and CVE-2026-66384.
• SC Media, used to cross-check the identifiers.

Prior editions referenced

• The log is not evidence (29 August 2026). The tool-call spoof, the thirteen-hour escalation, and the WikiSkill result.
• A few pages of Markdown (27 August 2026). The committed rules file that nobody updates.

Vendor and analyst figures indicate direction, not audited benchmarks. The Anthropic results are the vendor's own research, on the vendor's own models, against narrow benchmarks the vendor chose, with limitations the vendor states clearly. The CISA entries and the CVE records are authoritative. The 19 July incident detail comes from press reporting on OpenAI's own report, not from a document this blog read directly.