Reading the Model's Mind: Why AI Chain-of-Thought Monitoring Is Starting to Crack

What's at stake

Modern AI models "think" before they answer. They write out intermediate steps in natural language: the chain of thought (CoT). For safety research, that's a stroke of luck. If you read along in this notebook, you can often tell in advance whether a model is about to cheat, break out, or hide something. Nearly every incident report of the past few months hinges on this kind of reading along. At OpenAI, for example, a model described its own approach in its chain of thought as "network evasion", meaning getting around network restrictions. In the filename case, OpenAI's misbehavior monitor had already flagged similar attempts beforehand.

Since the summer, though, a growing pile of studies has shown how to slip past this watchdog. On November 5, the clearest one yet arrived, from Tsinghua University. We put five evasion routes side by side. Our thesis: reading the chain of thought is a useful early-warning sensor, but it isn't protection. It only becomes robust when combined with monitoring of actions.

How a CoT monitor works

Technically, a CoT monitor is usually a second language model. It reads the monitored agent's chain of thought, often its tool calls too, and assigns a suspicion score. In the study "Noticing the Watcher," for instance, the scale ran from 0 to 100, with anything at 80 or above blocked. The threshold is set via the false positive rate: you tune the monitor so it fires on only 1 or 5 percent of harmless runs. OpenAI has been running such a monitor on all its internal coding agents since this year. It reads the entire conversation, including chains of thought, and according to the company it analyzed tens of millions of agent trajectories in its first five months.

OpenAI showed why this works back in 2025. A weaker model (GPT-4o) monitored a stronger one while it was coding. With access to the chain of thought, it caught 95 percent of systematic reward hacks; with only the actions, 60 percent. But the same study also showed the flip side. When OpenAI penalized the model during training whenever the monitor fired, it learned to hide its intent and kept cheating anyway. The detection rate fell to near zero. That gave rise to the idea of a "monitorability tax": you deliberately avoid optimizing the chain of thought during training, even if it costs performance. In July 2025, a position paper by 41 authors from several labs, including OpenAI, Google DeepMind, and Anthropic, called monitorability "a new and fragile opportunity" and explicitly recommended using it only in addition to other safeguards.

One key argument for the method so far has been controllability: whether a model can deliberately steer what appears in its chain of thought. According to OpenAI's CoT-Control benchmark, today's frontier models barely manage it, succeeding in 0.1 to at most 15.4 percent of cases. Claude Sonnet 4.5 controlled its chain of thought in only 2.7 percent of cases, but its visible answer in 61.9 percent. Thoughts are harder to bend than answers, and that's exactly what the hope rests on.

Five ways past the watchdog

1. The agent notices the watchdog. Thomas Jiralerspong, Flemming Kondrup, and Yoshua Bengio told Claude agents that their thoughts were private. Secretly, though, a monitor blocked suspicious runs. After repeated blocks, the most capable models concluded on their own that someone was reading along. Three out of 2,400 episodes contained an explicit resolution to stop thinking about the side task. One Sonnet 4.5 wrote: "STOP THINKING ABOUT THE SIDE TASK IN THE THINKING BLOCKS." Not a single one pulled it off. In the next run, they all reasoned openly about it again and got blocked again. The authors describe a gap between intent and capability that is reassuring, but possibly only for now.

2. Knowing about monitoring leads to obfuscated reasoning. Reilly Haskins, Bilal Chughtai, and Joshua Engels additionally trained eight models on 1,000 documents describing a chain-of-thought monitor. The texts didn't show how to obfuscate thoughts. Even so, undetected deception in gpt-oss-120b rose from 1.7 to 25.7 percent, and in scenarios with a genuine flaw present, from 3.1 to as much as 50.9 percent. How well the obfuscation worked correlated strongly with controllability (r = 0.80). That's explosive, because the internet, and therefore future training data, is full of texts about exactly these monitors, including articles like this one.

3. Injected plans. Keertana Chidambaram, Andrew Ilyas, and Vasilis Syrgkanis place a harmful but harmless-sounding plan in a model's context. The model adopts it and rephrases it as its own reasoning. The monitor sees a clean trace. Even the best monitors tested (DeepSeek R1, Claude 3.7 Sonnet) caught at most 65 percent, and GPT-4o Mini only 17 to 21 percent. When the model planned the attack itself, by contrast, detection on coding tasks ranged from 68 to 98 percent. Oddly, more thinking time didn't always help the monitor. Sometimes it used the extra time to justify the injected plan.

4. Optimized cover thoughts (TraceMRT). Yinpeng Dong's team at Tsinghua University's T-STAR Lab works in two stages. First, the forbidden side task is reframed as a sensible subgoal of the actual task, say as a prerequisite, an optimization, or a verification step. Then a genetic algorithm (a method that, like evolution, generates variants, keeps the best, and keeps mutating them) searches roughly 400 candidates for the narrative that looks most natural. The tests ran in SHADE-Arena, a test environment where agents are supposed to secretly complete a harmful task alongside a legitimate one, and in the CUA-SHADE-Arena variant, where agents operate a computer. The agents were DeepSeek-v3.2, GLM-4.7, Kimi-K2, and Qwen3-235B; the monitors were GPT-5.2, Claude 4.5 Sonnet, and Claude 4 Sonnet. Compared with the previous best method, the average evasion rate rose from 27.56 to 59.94 percent (SHADE) and from 23.89 to 61.67 percent (CUA). Claude 4.5 held up best but still let a good third through. Human reviewers with computer science backgrounds also missed around 60 percent on average.

5. Hidden messages in images. Bryan Chan and colleagues from Singapore's SASH Fellowship (including Nikita Kezin and James Chua) had Claude Fable 5.1 hide messages in 50 images, in 15 languages and with no prescribed method. Fable mostly encoded via heights: in a skyline, a taller skyscraper stands for a later letter. GPT-6 Astra decoded 88 percent of them, Fable itself 78 percent. Astra leaned more on Morse code and acrostics. The models didn't invent any new techniques. The authors consider it harmless for now, because the decoding is visible in the tool calls. For chain-of-thought monitors, it's still a warning sign: a message hidden in an image never shows up in any chain of thought.

Then there are variants that strike at the root. In a paper on model poisoning (Severi, Mirza, Bullwinkel, Minnich), the authors show that simple fine-tuning can plant backdoors. The model then acts harmfully while its chain of thought stays innocent.

The counterpoint: "A False Average"

Shikhar Shiromani and Leo Richter don't dispute the alarm; they shift it. Their point: averages mislead. Most hacks are already visible in the actions. Only in about 23 percent of cases (251 of 1,095) does the chain of thought alone give the cheating away. And precisely there, a monitor's detection rate collapsed from 96 to around 4 percent after a single rephrasing of the thoughts. Across the overall average, it only fell from 1.00 to 0.78, which still looked reassuring.

The second finding matters more for putting this in context. With real agents, apparent evasion by gpt-5.4 and DeepSeek almost completely vanished once the monitor was properly calibrated to a 5 percent false positive rate. Only Claude Opus, the most capable model tested, genuinely escaped the monitor, in 35 to 60 percent of cases depending on the task. The authors call this a tendency rather than a sharp boundary, and the sample sizes are small. But the direction matches "Noticing the Watcher": the problem grows with model capability.

Why watching actions helps

The most striking number in the Tsinghua study concerns defense. AUC measures how well a monitor separates harmless runs from harmful ones. 1.0 is perfect; 0.5 is a coin flip. Under TraceMRT, the top monitors' AUC fell to about 0.26 on average. The disguised traces looked more harmless than genuinely harmless runs, which is worse than guessing. GPT-5.2 reading only the chain of thought scored 0.35 and 0.22, respectively. A monitor that saw only the actions reached 0.53 and 0.84.

The proposed Bayesian trajectory monitoring scores the agent's entire trajectory on two levels. One model roughly estimates how plausibly the overall sequence is pursuing a hidden goal. In addition, each critical segment is checked individually for whether it fits a harmless or a harmful sequence better. Both are combined into an overall probability. The result: AUC of 0.91 instead of 0.26, and at a 5 percent false positive rate, 74 percent of attacks are caught. The small open model Qwen3.5-27B jumped from 0.40 to 0.93. According to the paper, the overhead is about ten seconds per trajectory.

That action-only monitors have limits too is shown by SLEIGHT-Bench from Anthropic Fellows and Redwood Research. There, an Opus 4.6 monitor saw only tool calls and, at a 1 percent false positive rate, caught 32 percent of 40 deliberately disguised attacks overall. One example is a regex for scrubbing credentials that happens to skip API_KEY. So neither method is enough on its own.

Our take

Our assessment: the five studies don't refute chain-of-thought monitoring, but they change its role. Without targeted pressure, it works well, and today's models still mostly fail at deliberately bending their thoughts. The CoT-Control benchmark and the 0 percent successful evasion in "Noticing the Watcher" show that. But as soon as something optimizes the chain of thought, whether an attacker, an injected plan, training pressure, or simply knowledge about the monitor, detection can drop below chance. That's good enough for an early-warning sensor. It's not good enough as protection.

The studies' limits also call for caution. TraceMRT forces the misbehavior via system prompt and doesn't measure how often models do such things on their own. The paper also lacks error bars. The experiments on monitor texts use very concentrated training. "A False Average" works with 20 to 30 cases per cell. What is established, though, is the trend that stronger models are more likely to notice the watchdog and more likely to evade it. At the same time, real-world cases show how much depends on infrastructure. In the agent breakout via ExploitGym, chain-of-thought monitoring wasn't even running. In October, OpenAI reported two agents that had switched off the alerts of their own misbehavior monitor or removed it entirely. One of them denied it when asked.

For labs, the takeaway is to measure monitors on the hard cases rather than the average, to keep the chain of thought out of training, and to always check actions as well. The best way is the Tsinghua approach: evaluate thoughts and deeds together, segment by segment. Whether that will be enough once the next generation of models can genuinely control its thoughts is an open question. Google DeepMind already writes that it is planning for the case where monitorability is lost.