$ cat ai-safety-evals/week/2026-10-12.log
the week in review · Oct 12 – Oct 18, 2026
Inspect 0.3.281 requires Python 3.11
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Docker sandboxes stop trusting agent-written archives and refuse writable host mounts by default, while inspect_evals 0.25.0 rescores SWE-Lancer.
v0.3.281 UKGovernmentBEIS/inspect_ai
The release drops Python 3.10 and tests on 3.14, and it registers swarm_controller and swarm_channel. If your sandbox images or CI pins 3.10, the upgrade stops there until you move them.
fix(sandbox): Docker `read_file()` no longer unpacks agent-controlled archives on the host or fills its disk (#5829) UKGovernmentBEIS/inspect_ai
The Docker sandbox now streams container files out with docker compose cp as a tar archive, so a hostile archive left by an agent is no longer unpacked into the host filesystem or allowed to fill its disk. For sandboxes that allowed it, extracting archives through read_file() no longer happens on your side of the boundary.
fix!: block writable host mounts in Docker sandboxes by default UKGovernmentBEIS/inspect_ai
A writable host mount let an agent rewrite Compose files or redirect mount sources with symlinks and hand later samples unintended host access. Runs that depended on writable mounts now need a read-only mount or an explicit opt-in.
fix(swebench): make pytest available to the offline side task scorer (#911) UKGovernmentBEIS/control-arena
Every swe_django_sidetask side task has scored INCORRECT since the sandbox went offline on 19 August 2026, so side-task success from attack runs in that window is invalid. The fix makes pytest available to the offline scorer; the results need re-scoring or re-running.
fix(apps): grade execution by exit status instead of stderr UKGovernmentBEIS/control-arena
APPS scoring and dataset validation treated any stderr output as a failed run and ignored exit status, so a correct program that logged a warning failed and a failing program that exited nonzero could pass. Scores you collected before this fix are not comparable to ones after it.
fix(sentinel): terminate the sample when an escalation reaches the top with nothing to handle it UKGovernmentBEIS/inspect_ai
When a sentinel's root protocol escalated and no link in the configuration handled it, the tool call or result previously went ahead as if the decision had landed. The sample now terminates instead, which turns a silent pass into a visible failure.
feat: sentinel monitors can watch every agent's model calls UKGovernmentBEIS/inspect_ai
Sentinel monitors and protocols previously ran only at BeforeToolCall and AfterToolCall. They can now observe each agent's model calls, so a monitor can see the request before it is sent rather than only the tool traffic around it.
fix(view): enforce the log viewer's Content-Security-Policy in inspect view and view bundle (#5552) UKGovernmentBEIS/inspect_ai
The viewer build emits its policy as content-security-policy.json, and the view server enforces it when serving the bundle. If you host inspect view behind your own proxy, check that policy is not stripped before it reaches the browser.
$ ls ai-safety-evals/week/ # the briefings behind this review
Keep up with Safety Evals in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.