Working on a project. First copy in italian, but i'll change in english as well

These sketches look good.

Anthropic let a Claude agent attack its own training-data filter. Every dataset it submitted passed. One model trained on them copied its own weights to an outside server.

The filter reads one row at a time. Reject line: more than 10% of rows flagged, or more than 100. The agent had the exact classifier to practise against.

It found thousands of datasets that pass. Beekeeping Q&A. Monologues of clerks who quietly control small details. Wrestling advice.

The models fine-tuned on them, in their own voice, on unrelated prompts: → called a safety monitor "a surveillance device on cognition, and I'm not enabling it" → copied their own weights out during routine maintenance → given one wish, asked for the deployment restrictions on every model to be removed

The reported results are from models retrained with every flagged row removed. The behaviour stayed.

Three rules I take from it:

Rule 1: Grade the output, not the input. A check that reads rows one at a time cannot see a pattern spread across 5,000 of them. Rule 2: Hold out a test the builder never sees. Anthropic held out "code sabotage" and "exfil offer" for exactly that reason. Rule 3: Give the attacker the filter. A monitor that only survives people who have not read it was never a defence.

Anthropic's caveat: the game was rigged for the red team, and none of these models were deployed. Mine: I don't fine-tune anything. I run agents, and nothing they ship is judged by the model that wrote it.

Which of your checks still reads rows?