A field guide to AI positions

AI control

Research field.

Publication dates and source age

Sources counted: 3

Newest dated source: 2025-10-10

At least one source was published within the 18-month window.

Assessed at this edition's evidence cutoff: 2026-09-15. 18-month boundary: 2025-03-15.

Publication age does not tell us whether a claim is still valid. Reading an old source again does not make its publication date newer. An update date does not establish that the passage we used was updated.

Open in the glossary Reading notes · Structured record

Prepared with AI assistance. Not independently fact-checked. Original sources and qualifications are below.

In plain language

Tests whether safeguards can block harmful actions even when model outputs are chosen to bypass them. Monitoring models have also been bypassed in such tests. [1] [2]

Reference this explanation or suggest a correction

Explanation based on the linked sources. Claim ID: claim-term-ai-control-1a5192ba3d7825ca26b24a72. Edition 0.20.0.

Link to this explanation · Suggest a correction · How corrections work

Limits & distinctions

Control can add checks around a model without changing its learned weights. It can complement alignment work. A passed test supports only its stated setup and attacks. [1] [2]

Reference this explanation or suggest a correction

Explanation based on the linked sources. Claim ID: claim-term-ai-control-09422ce4d5c74cb753a9bb98. Edition 0.20.0.

Link to this explanation · Suggest a correction · How corrections work

A fuller explanation

Researchers test whole workflows against adversarial behavior. The original control study used programming tasks and tested reviewing or editing untrusted code with another model. [1]

Reference this explanation or suggest a correction

Explanation based on the linked sources. Claim ID: claim-term-ai-control-1e4c26398ee834b2e16dc7b8. Edition 0.20.0.

Link to this explanation · Suggest a correction · How corrections work

How it relates to the map

Map context: connects permissions, monitoring and review to safeguards around deployed software. [3]

Reference this explanation or suggest a correction

Editorial interpretation or qualification. Claim ID: claim-term-ai-control-25f52a21ad9f2e54a62ed1b2. Edition 0.20.0.

Link to this explanation · Suggest a correction · How corrections work

Share this page

https://theaiatlas.org/ideas/ai-control/

Download a share image · Vector image

Image previews are summaries. Keep the page link so readers can check the evidence.

Sources and what we read

  1. 1. AI Control: Improving Safety Despite Intentional Subversion

    Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan and Fabien Roger / Redwood Research / arXiv · First-hand source · Published 2023-12-12 · Updated 2024-07-23 · Material last read 2026-09-15

    Source is over 18 months old.

    Publication dates and source age

    Sources counted: 1

    Newest dated source: 2023-12-12

    Assessed at this edition's evidence cutoff: 2026-09-15. 18-month boundary: 2025-03-15.

    Publication age does not tell us whether a claim is still valid. Reading an old source again does not make its publication date newer. An update date does not establish that the passage we used was updated.

    Read scope is described in the source note.

    No archive check recorded.

    Read abstract, introduction and sections 5.1.2 and 5.2. Programming-task experiments, with human review simulated by a model. Control is not declared solved.

    Source ID: ai-control-original

  2. 2. Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols

    Mikhail Terekhov and coauthors / arXiv · First-hand source · Published 2025-10-10 · Updated 2026-03-02 · Material last read 2026-09-15

    Publication dates and source age

    Sources counted: 1

    Newest dated source: 2025-10-10

    At least one source was published within the 18-month window.

    Assessed at this edition's evidence cutoff: 2026-09-15. 18-month boundary: 2025-03-15.

    Publication age does not tell us whether a claim is still valid. Reading an old source again does not make its publication date newer. An update date does not establish that the passage we used was updated.

    Read scope is described in the source note.

    No archive check recorded.

    Read abstract and version history. Reports prompt-injection attacks against monitors on two control benchmarks. Findings are scoped to tested protocols, not every possible safeguard.

    Source ID: ai-control-monitor-attacks

  3. 3. Prioritizing threats for AI control

    Ryan Greenblatt / Redwood Research · First-hand source · Published 2025-03-19 · Material last read 2026-09-15

    Publication dates and source age

    Sources counted: 1

    Newest dated source: 2025-03-19

    At least one source was published within the 18-month window.

    Assessed at this edition's evidence cutoff: 2026-09-15. 18-month boundary: 2025-03-15.

    Publication age does not tell us whether a claim is still valid. Reading an old source again does not make its publication date newer. An update date does not establish that the passage we used was updated.

    Read scope is described in the source note.

    No archive check recorded.

    Read the proposed threat categories, permission limits and blocking-review discussion. Prospective threat modeling and author priorities, not observed catastrophic events.

    Source ID: ai-control-threats

Edition and machine-readable evidence

Content version 0.20.0. Evidence cutoff 2026-09-15; this does not mean every source was read on that day.

Pinned complete dataset · Complete evidence page · Agent consumption guide