James Mickens argues chain-of-thought monitoring can never be a sound security control.

arXiv 2609.02852 introduces "linguistic illegibility," the gap between what a model says and the math it performs over activation spaces, and argues chain-of-thought monitoring, constitutional self-critique and activation probing are unsound in principle as security mechanisms. The proposed alternative is sandboxing resting on techniques independent of what the model reports, specifically taint tracking over which system states a model's output influenced. arXiv Spend the effort on the boundary, not on reading traces.