# Red-teaming that gets better when you add compute (slim)

> Vlad Cealicu on Anthropic's research where Claude agents wrote training data that slipped past a safety monitor, and why safety testing that scales with compute instead of researcher hours is good news.

- Full: https://www.anchorterminal.com/blog/red-teaming-that-scales-with-compute.md (~1,550 tokens) · this version ~730 tokens · JSON https://www.anchorterminal.com/blog/red-teaming-that-scales-with-compute.json · canonical https://www.anchorterminal.com/blog/red-teaming-that-scales-with-compute
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-31
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

By Vlad Cealicu, 31 October 2026. 683 words, about 3 min to read.

At the end of October 2026 Anthropic's alignment team published research where Claude agents had one job, to write training data that a safety monitor wouldn't flag but that would still teach a model to misbehave [[1]](#ref-1).

That reads like a scary headline, and plenty of people will post it that way.

## The bottleneck was people

Red-teaming has always been people sitting down and trying to break a model, and there are only so many of them with only so many hours.

I think that's the important sentence in the paper.

## What the agents did

Each agent had code execution and could fine-tune.

Nobody told them which tricks to use.

(This isn't a finding about how deployed Claude models behave, and the authors say so.

## Why I think this is good news

Every dataset that got through is now a test case for the next monitor, and the authors say the examples could be used to test and improve future monitors [[1]](#ref-1).

We do the same thing at Anchor Terminal on a much smaller scale.

## What's still open

The authors list the limits themselves.

I think the question for the next year is whether the defence gets as much compute as the attack.

---

More in [Opinion](https://www.anchorterminal.com/blog/opinion/index.md) · Older opinion [Two million page views took two years last time, and a month this time](https://www.anchorterminal.com/blog/what-the-next-model-is-for.md) · Newer opinion [We already have AI judges, but not at the top courts yet](https://www.anchorterminal.com/blog/ai-judges-not-at-the-top-courts-yet.md)

- Older: [Two million page views took two years last time, and a month this time](https://www.anchorterminal.com/blog/what-the-next-model-is-for.md)
- Newer: [We already have AI judges, but not at the top courts yet](https://www.anchorterminal.com/blog/ai-judges-not-at-the-top-courts-yet.md)
- All posts: https://www.anchorterminal.com/blog/index.md

## References

Read on 31 October 2026.

[1] Oscar Balcells Obeso, Richard Qi, Monte MacDiarmid and Evan Hubinger, "Automated subtle emergent misalignment research", Anthropic Alignment Science Blog, October 2026. Source for the setup (datasets of up to 5,000 examples, the 10% flag cap, the score and the cheat checks), the thousands of datasets across runs, the beekeeping, wrestling and blackmail examples, roleplay and fiction as the winning pattern, the quote on compute, using the examples to improve monitors, and the limits and next steps.