A lab reports that its monitoring systems block roughly one action in 47,000, across a fleet of around thirty thousand agents running simultaneously. That implies the existence of an entire software layer whose only job is to watch what the models do and step in. How does it work, and what does it base its decisions on?
We reported these self-improvement figures this morning. Here is the plumbing that goes with them.
The three places where you can monitor
Before the action. The system examines what the agent is about to do and decides whether to let it through. This is the most effective, because nothing has happened yet. It is also the most costly, because every action has to be assessed before execution.
During reasoning. The model's internal draft is read to spot a problematic intention before it becomes an action. This is what reasoning models make possible, and it is precisely the mechanism that the GPT-6 Astra safety report indicated could be circumvented under adversarial conditions.
After the fact. Logs are analysed to spot what should have been blocked. This is the cheapest and the latest: useful for improving the rules, useless for preventing anything.
Who monitors, and the problem that creates
Here is the most interesting point. At this scale, monitoring cannot be human: thirty thousand agents produce far too many actions.
So other models do the monitoring. A smaller, faster, specialised system examines the actions of a more capable one.
This creates a difficulty that cannot be sidestepped: the monitor is less capable than the monitored. If the main model finds a way to phrase an action that the monitor does not recognise as problematic, it goes through.
This is exactly the problem we described in our article on tests that have themselves become a risk: you cannot measure a capability without giving what you are measuring the opportunity to exercise it on the measuring instrument.
Any system of this kind has a dial, and there is no good setting. Too strict, and it blocks legitimate work — and in a lab where agents do 26% of the research, that costs directly in productivity. Too permissive, and it lets through what it was meant to catch. One action blocked in 47,000 describes a position on that dial, not a performance. Without knowing how many problematic actions got through, that rate says nothing about effectiveness — the same limitation we highlighted for automated ad moderation.
What works best
Two approaches stand out, and neither relies on the intelligence of the overseer.
Structural limits. Rather than judging every action, you restrict what is possible: no unnecessary network access, no credentials for the main system, minimal permissions. This is the principle of least privilege that we detailed in our access guide. An impossible action does not need to be detected.
Anomaly detection. Rather than looking for what is bad, you spot what is unusual: an agent accessing resources it never touches, an atypical volume of requests, an unexpected data egress. This approach does not require understanding intent.
What to take away
Agent monitoring is a young field, and most organisations deploying agents have none of it.
The practical advice that follows is simple and rarely heeded: before investing in a sophisticated detection system, reduce what your agents can reach. A good permissions architecture catches more problems than a good overseer, because it does not depend on the ability to recognise intent.
It is less elegant, and it is what holds up.