Redwood Research introduces Screwtape, a pipeline that edits agent transcripts to red-team action-only monitors

Redwood Research introduces Screwtape, a pipeline that inserts an attack into a real agent transcript and repeatedly refines it until an action-only monitor no longer catches it, with an LLM verifier checking realism and severity. Across 252 runs on 94 unique transcripts, it produced 35 attacks that evaded Redwood's own Opus 4.8 and Gemini 3.1 Pro based monitors, and 6 of those also evaded a held-out monitor from a frontier developer and were confirmed valid by human review. The authors note the pipeline cannot produce quantitative safety estimates, currently cannot generate reasoning traces for chain-of-thought monitors, and is not being released publicly, though they are open to sharing it with researchers.