Async Control: Stress-testing asynchronous control measures for LLM agents

The researchers model stress-testing asynchronous monitoring for LLM agents as a red-team/blue-team game, in which the blue team designs monitors and the red team constructs subversive agents, and attempt to set game rules such that its upper bound is based on the sabotage potential of a Claude 4.1 Opus-based agent. Asynchronous monitoring reviews agent actions after the fact, adds no runtime latency, and attempts to interrupt attacks before irreversible harm occurs. The team developed 5 software engineering environments simulating AI developer internal infrastructure tasks, and the resulting integrated monitor achieves a 6% false negative rate at a 1% false positive rate on held-out test environments. The paper also presents a simple model for extrapolating deployment-time sabotage risk from the monitor's false negative rate, a sensitivity analysis, and cases where the model fails; code is open-sourced at https://github.com/UKGovernmentBEIS/async-control。