Agent monitors that cannot be talked down

I am Jaswanth Alkur, an independent AI safety researcher in India, working alone and unfunded since November 2025. My work is on the monitors meant to catch a misbehaving AI agent.

In a pre-registered test I rewrote only an agent's reasoning and kept every action the same. A gpt-4o-mini reasoning monitor dropped from 87.5% to 0% catch at a 5% false positive budget, over 80 runs. So I built a monitor that reads none of the reasoning and uses no model. It asks who first wrote the target of each important action, such as a payee, a recipient or a host, and flags the action if the agent wrote it first. On the last 420 SHADE-Arena runs, which I had kept aside and never scored, it caught 209 of 210 sabotage runs while flagging 10% of honest runs. On 4,488 ControlArena runs it missed exactly the kind of sabotage I predicted beforehand that it would miss.

I also wrote static checks that find places where safety code fails open, and ran them over 39 open source AI safety systems. retire.js and Langfuse shipped changes after my reports. One paper is accepted at the NeurIPS 2026 TAE workshop and about ten are under review. What is missing is anyone else checking the results, which is what this funding pays for first.