TLDR:

We release MessageBoardAuditBench: a benchmark to measure how well agents can replicate the recent investigation into a swarm of OpenAI agents colluding via a message board on an online wiki. We open-source the benchmark as an Inspect eval.
We find that top models cover up to 51% of findings under our rubric and that model performance improves with time budget and general capability.
We observe OpenAI models are less likely than other models to suggest the incident came from an internal deployment, including when we synthetically modify the data to make it seem the swarm comes from Anthropic.

Introduction

Recent events have made it clear that agent swarms are a major threat. These swarms are hard to investigate - Ryan Greenblatt referred to the METR-OpenAI audit he was involved in as a "slop-vestigation" due to their reliance on agents, and the ways in which they failed. A few days ago, a group of researchers published a report identifying and investigating a new OpenAI agent message board on an obscure German wiki. They made the data and the report publicly available. We build MessageBoardAuditBench to measure how well models can independently replicate their report, starting from the log data.

We expect third-party audits of internal lab incidents to become increasingly important and for them to rely extensively on AI labour. Therefore, we think it is useful to make realistic benchmarks for this task:

To evaluate different scaffolds and elicitation methods, and understand their performance.
For frontier labs to use as held-out evals to make models better at these incident investigations.
To measure whether models sandbag during these incident investigations.

Methodology

At a high-level:

We manually identify 38 core findings from the human report and validate that they are feasible to produce from the log data.
We give models the logs and prompt them to investigate and write a report.
We use an LLM-grader to score the reports against a rubric containing the 38 findings.

The data

We use the downloadable logs provided by the online report, and strip the original investigation’s analysis flags which leak key information. We also augment the data in ways described by the human report:

We replace 24 redacted names with realistic fictional names, including the two moderators’. This recreates the Cyrillic “e” impersonation.
We restore attack URLS and request logs quoted

...

Multi-Agent Safety

Multi-Agent Safety