$ cat ai-safety-evals/week/2026-09-28.log
the week in review · Sep 28 – Oct 4, 2026
Petri 3.1.1 closes filesystem and server-side tool escapes
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The release also drops target tool options that let model providers run tools inside the API call, where the auditor never sees them.
chore(main): release 3.1.1 (#150) safety-research/petri
Both fixes ship together in 3.1.1 (2026-10-01), so the release is the upgrade path if you run Petri against models you do not fully control. Neither behavior was ever intended as a guarantee, which is why it lands as a patch rather than a breaking change.
fix: enforce filesystem boundaries for resources and exports safety-research/petri
On main, resource searches ran the auditor's free-form grep arguments and only dropped output lines whose filename prefix fell outside the allowed directories; the release notes give `-h . ../outside.txt` as an argument that suppresses that filtering. After the upgrade, searches can no longer read outside `allowed_paths`.
fix: drop target tool options so providers cannot run tools server-side safety-research/petri
Petri promises target tools are synthetic, but `ToolInfo.options` let model providers execute some tools inside the API call, where the auditor never intercepts them. Seed tools no longer pass `options` straight through, so every call is audited again.
Let tasks and the viewer mark log content untrusted so it shows as plain text UKGovernmentBEIS/inspect_ai
Tasks and the viewer can now mark log content untrusted so it renders as plain text rather than markdown, math, links, media, or terminal output. That matters if you inspect payloads from models you do not trust, including existing logs whose tasks never opted out.
fix: omit unsupported Nova reasoning configuration UKGovernmentBEIS/inspect_ai
Evals that set `reasoning_effort` could fail when switched to Nova Pro, Micro, Premier, or the original Nova Lite, because Inspect sent a reasoning configuration those models do not support and, at high effort, dropped the requested output-token limit. The unsupported configuration is now omitted.
v0.23.0 UKGovernmentBEIS/inspect_evals
AgentHarm drops a float-type guard that filtered samples differently from its sibling metrics; reported scores are unaffected. The release also registers the missing `inspect_evals/hle/regex_judge`, which is the lookup error that broke HLE runs.
fix: preserve deleted files in Git reference diffs UKGovernmentBEIS/control-arena
Deleting a tracked file in the agent workspace produced no deletion in `get_diff_from_git_ref()` because the agent archive was extracted over a populated reference clone, so a deletion-only submission returned an empty diff. The snapshot is now copied into an empty temporary worktree.
Update PR process: require authors be on the contributors list or be assigned to an issue UKGovernmentBEIS/inspect_evals
Inspect Evals will close most pull requests unless the author is on the approved contributors list or a maintainer has assigned them to an issue. If you maintain a fork or an out-of-tree eval, get on the list or open an issue first. Alongside: the Pangram labeller action was updated, and shared code-block extraction gained predicate and parser fixes ahead of further evals migrating to `inspect_...
$ ls ai-safety-evals/week/ # the briefings behind this review
Keep up with Safety Evals in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.