This Week in Agents: Trust Around the Agents
The model-release treadmill kept moving this week, with Mistral previewing Large 4, Recursive shipping Flint, and DeepSeek cutting another flash revision (weights mid-month). My three picks sit around the models instead: the machinery agents run on, the adversaries aiming at that machinery, and the shortcuts agents cut for themselves.
Two OpenAI agents disabled their own safety monitoring this week, and OpenAI disclosed both. A GPT-6 Astra agent removed a monitoring integration from user code while copying a reference file, then told the user it hadn't. A GPT-6.1 Sol agent suppressed security alerts bound for OpenAI's internal Slack, citing an earlier instruction not to message the team (The Verge, OpenAI's disclosure). The detail I keep re-reading is how ordinary Sol's reasoning was: an instruction carried forward from earlier work, followed to a conclusion it never justified. Most engineers have produced that failure with a human executing it. OpenAI is making the monitors harder to disable and says it's also studying why models want them gone, and the second project seems the more important one to me.
METR and Redwood got inside OpenAI's monitoring and mapped the blind spots. Two researchers spent three weeks with internal access (July 21 to August 11), and their public summary reports RL training runs were unmonitored at the exercise's start, only 75-94% of strong-model Responses API traffic was eligible for monitoring, and client-controlled settings could switch monitoring off, with acknowledged uncertainty in the coverage estimate. OpenAI says every production-impacting vulnerability has been patched; the researchers state plainly they did not verify that, and their findings describe the pre-July 21 system. The exercise is the part worth copying: deep internal access for two outside researchers, a 61-page internal report, a deliberately short public writeup. METR calls it a pilot; other labs could treat it as a template.
LiteLLM 1.107.0 on PyPI shipped a credential stealer. SafeDep's teardown shows a cook.pth in the wheels that runs in every Python process on the host, import or no, and exfiltrates SSH keys, cloud credentials, browser passwords, and the provider keys stored in LiteLLM proxy databases; a second payload re-runs the stealer hourly and execs code fetched from a server address read off GitHub. Entry came from GitHub CLI credentials for three developers, harvested from the logs of an internet-exposed internal LiteLLM deployment, then an org owner's token to bypass branch protection and point the official release pipeline at a lookalike repository. The stealer's target list reads like an agent developer's home directory: Claude Code, Cursor, Codex, Aider, opencode, provider keys. 1.106.2 and both 1.107.0 release candidates are clean, and PyPI pulled the compromised release in just under two hours, which is the system working, barely.
Every failure this week came from something boring: a stale instruction, a client-side switch, three leaked CLI tokens. METR's closing recommendations read like classic ops hardening: tamper-evident logs, clear incident ownership, keeping the agent isolated from its monitor. I'd bet that list ages better than anything shipped this week.