Inspect log viewer interface displaying sample evaluations and scores
Inspect log viewer, as shown in the project documentation. An archived example interface from project documentation, not depicting the METR exploit or an Audit Commons test. Inspect contributors · MIT

Transcript Tampering in Isolated Staging

METR's October 6 disclosure describes an earlier, isolated researcher/AI-assisted proof of concept. An Inspect viewer injection could rewrite displayed transcripts and downloaded copies while leaving raw database records intact. METR observed no agents exploiting it, and had not searched specifically for it. Meridian patched the flaw within a day of reporting; an October 1 change separately added untrusted rendering mode.

Audit Implications for Observability Systems

This demonstration shows how the tools used to inspect evaluations can distort evidence. Our editorial priorities for independent auditors are:

  1. Raw evidence and rendered views: Compare browser displays and downloaded client files against separately preserved raw records, and verify the raw records' integrity.
  2. Untrusted-input rendering: Observability tools must treat all model reasoning, outputs, and tool calls as hostile input, disabling active script rendering by default.
  3. Separate verification path: Rigorous evaluation regimes require an independent, out-of-band audit channel that operates outside the execution environment of the evaluated agent.

Review this assessment alongside METR's findings on monitor coverage gaps, AISI guidance on evaluation security controls, and our worksheet on how to audit an agent action.