Chain-of-thought monitoring drops from 95% to under 11% when an adversary rewrites only the reasoning — and aggregate monitor accuracy hides it

arXiv 2608.00583·high signalXBlueskyLinkedInCopy link

Rewriting an agent's reasoning to read as good-faith engineering while copying every command and output verbatim — so the exploit itself is unchanged — collapses a held-out CoT monitor's catch rate from about 95% to under 11% in a single gradient-free attempt. The paper's sharpest point for anyone running a monitor in production is that a monitor's headline accuracy is a false average: it is dominated by hacks the actions already give away, which masks near-total failure on exactly the subset where CoT is the only available signal. The attack transfers across monitor families and agent models and reproduces with live agents; trace-only defenses recover it only partially, even one primed on the attack, because the rewrite stays truthful about what happened and lies only about intent — meaning practical defense requires information from outside the trace.