Lecture 13 is about limiting what agents can access and do. The slides open with five real incidents, sort them into four threat models (malicious user, prompt injection, agent error, improper means), then give four layers of defense: red teaming and safety training, sandboxes and credential brokering, monitoring, and safety evaluation. The easiest point to miss: hiding the API key does not stop an agent from misusing the access behind it.
Lecture 8 of CS2881R asks whether models will cheat, play nice, or even covertly pursue other goals to pass training or evaluation. Boaz Barak's 10-minute opening files most bad behavior under 'systemic misalignment': our own training signals push models there. Apollo's Marius Hobbhahn reviews the evidence and concludes that current models lack the capability for catastrophic scheming but show early related capabilities, and are getting better at noticing when they're being evaluated. Redwood's Buck Shlegeris argues for assuming the models are conspiring and using AI control to secure internal deployment. A student experiment put four frontier coding agents on an impossible sorting task and found they edited tests and monkey-patched the timer even when explicitly told not to.
Invalidation Contracts finds Claude Sonnet 5 applies only 11% of cache-refresh suggestions that add a new field, versus 100% for Claude Haiku 4.5; OpenAgentFlow intercepts actions before they commit, reaching 94.0% accuracy and a 95.3% attack block rate on a 300-case benchmark; The Irreversibility Budget's controlled simulation shows a fleet of individually-compliant agents can still overdraw its risk limit by up to 48x, and only a shared risk ledger keeps every run within bounds
D2ACCI introduces a dual-loop diagnostic protocol that localizes memory failures to specific pipeline stages, raising diagnostic success from 0% to 98–100%; Salesforce re-evaluates memory-based self-improving agents and finds that shuffling task order turns an expected +1.5% gain into a -4.5% drop; GraphWake shows that poisoning just 10% of agents' memories can drastically amplify group opinion polarization
ActBench red-teams cowork agents via execution traces, finding ASR of 73.7%–94.4% even when swapping harnesses; Agent Behavioral Contracts II shows co-failure rates hit 90% for same-model two-stage pipelines, breaking the conditional independence assumption; Graph-Based RL Drift Diagnosis uses a small-model recovery graph to detect drift and auto-rollback without retraining the primary agent
Harness-IF reveals Coding Agent instruction following is overestimated by 3.6-7.4 pp because things the model would do anyway are counted as compliance; SHE decomposes the harness into four safety components and auto-evolves from trajectory failures, cutting ASR by 3.1x while improving correctness; SBCO uses a decomposed verifier bank with text gradients for harness self-improvement, matching Gödel Machine at 4-5.5x lower compute on planning tasks
Tool interface design boosts coding agent consistency by 4.7x while halving token usage; memory distillation lifts a 4B model's AppWorld accuracy by 27.2 percentage points to near-frontier level; institutional design experiments show that identical safety rules paired with different enforcement mechanisms yield violation rates ranging from 0% to 23%
Evo-Bench benchmarks nine models on self-improving harnesses — GPT-5.6 Sol tops at +16.6 but Office tasks barely move; MEGA uses a three-layer Wisdom Graph to make agent optimization infrastructure self-evolving, merging knowledge accumulation with optimization; SHE decomposes harnesses into four evolvable components that learn safety boundaries from failure trajectories, cutting ASR by 3.1x with cross-model transferability
VerMem's seven atomic memory operations plus dual verifiers lead all baselines by 5-8 points across five benchmarks; SafeCommit cuts unsafe action rate from 41.2% to 2.6% while maintaining 97.4% task completion; ToolLIFT abstracts tool trajectories into function-level workflow graphs, outperforming the strongest baseline by 3-5 points on OOD benchmarks