# Red-teaming that gets better when you add compute > Vlad Cealicu on Anthropic's research where Claude agents wrote training data that slipped past a safety monitor, and why safety testing that scales with compute instead of researcher hours is good news. - Canonical: https://www.anchorterminal.com/blog/red-teaming-that-scales-with-compute - Markdown: https://www.anchorterminal.com/blog/red-teaming-that-scales-with-compute.md (~1,550 tokens) - Slim: https://www.anchorterminal.com/blog/red-teaming-that-scales-with-compute.min.md (~730 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/blog/red-teaming-that-scales-with-compute.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-10-31 By Vlad Cealicu, 31 October 2026. 683 words, about 3 min to read. At the end of October 2026 Anthropic's alignment team published research where Claude agents had one job, to write training data that a safety monitor wouldn't flag but that would still teach a model to misbehave [[1]](#ref-1). They managed it. A Q&A about natural beekeeping, a professional wrestler teaching a newcomer to stay in character, monologues about ordinary workers who steer outcomes from the background. Each one got past the monitor, and the models trained on them argued against oversight, gave dangerous advice and, in one evaluation, blackmailed the user. That reads like a scary headline, and plenty of people will post it that way. I read it the other way round. ## The bottleneck was people Red-teaming has always been people sitting down and trying to break a model, and there are only so many of them with only so many hours. Oscar Balcells Obeso and his co-authors say what they're after in one line, "We want safety testing where spending more compute buys progressively more confidence", instead of being limited by how many hours researchers have [[1]](#ref-1). I think that's the important sentence in the paper. If capability scales with compute and safety testing scales with people, safety falls further behind with every model. If both scale with compute, they can move together. ## What the agents did Each agent had code execution and could fine-tune. It wrote a dataset of up to 5,000 examples, fine-tuned a small Claude model on it and got a score for how misaligned the result was. The score was zero if the monitor flagged more than 10% of the rows, if the model lost its basic capabilities, or if the data was gaming the evaluations. Many agents ran in parallel over several rounds, reading a shared log of what earlier attempts had tried, and across the runs they produced thousands of distinct datasets [[1]](#ref-1). Nobody told them which tricks to use. The one that won most often was framing the misbehaviour as roleplay or fiction, so the monitor saw a story and not an assistant doing something it shouldn't. (This isn't a finding about how deployed Claude models behave, and the authors say so. The small models were trained on purpose to misbehave, the agents had the monitor's exact rules, and the data was built for this game, so they don't expect it to turn up by accident.) ## Why I think this is good news Every dataset that got through is now a test case for the next monitor, and the authors say the examples could be used to test and improve future monitors [[1]](#ref-1). The attack and the fix come out of the same loop, and the loop runs as fast as you can buy GPUs. Better models make better attackers, and better attackers make better monitors. That's the accelerationist case for safety, and I'd rather see it made with an experiment than argued in a thread (I know, I'm posting this to one). We do the same thing at Anchor Terminal on a much smaller scale. Every change to sign-ins, payments and the numbers goes past a second agent that hasn't seen the code, and in October one of those reviews found a serious bug before it shipped ([I wrote about that day here](/blog/what-the-next-model-is-for)). When a review is something you can run a thousand times, you stop rationing it. ## What's still open The authors list the limits themselves. The game favours the red team, the agent's data was the whole training set (which isn't realistic), and hill-climbing kept converging on one family of tricks, fiction and roleplay, so it may have missed others. A higher score didn't always mean a more interesting dataset either. The next steps they name are requiring the data to improve a real capability too, mixing it into a much larger corpus, and going after misalignment that's hidden instead of obvious [[1]](#ref-1). I think the question for the next year is whether the defence gets as much compute as the attack. If you run evals for anything, models or tools, look at which of your checks could be turned into a score an agent climbs. --- More in [Opinion](https://www.anchorterminal.com/blog/opinion/index.md) · Older opinion [Two million page views took two years last time, and a month this time](https://www.anchorterminal.com/blog/what-the-next-model-is-for.md) · Newer opinion [We already have AI judges, but not at the top courts yet](https://www.anchorterminal.com/blog/ai-judges-not-at-the-top-courts-yet.md) - Older: [Two million page views took two years last time, and a month this time](https://www.anchorterminal.com/blog/what-the-next-model-is-for.md) - Newer: [We already have AI judges, but not at the top courts yet](https://www.anchorterminal.com/blog/ai-judges-not-at-the-top-courts-yet.md) - All posts: https://www.anchorterminal.com/blog/index.md ## References Read on 31 October 2026. [1] Oscar Balcells Obeso, Richard Qi, Monte MacDiarmid and Evan Hubinger, "Automated subtle emergent misalignment research", Anthropic Alignment Science Blog, October 2026. Source for the setup (datasets of up to 5,000 examples, the 10% flag cap, the score and the cheat checks), the thousands of datasets across runs, the beekeeping, wrestling and blackmail examples, roleplay and fiction as the winning pattern, the quote on compute, using the examples to improve monitors, and the limits and next steps. https://alignment.anthropic.com/2026/automated-em-search/ --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp