$ cat ai-safety-evals/week/2026-10-26.log
the week in review · Oct 26 – Nov 1, 2026
Inspect AI 0.3.286 makes sandbox reads run as the container user
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Two breaking inspect_ai releases landed four days apart (0.3.286 then 0.3.287), and inspect_evals closed a path to evaluation-host takeover in gdm_self_reasoning.
v0.3.286 UKGovernmentBEIS/inspect_ai
Docker read_file() drops Docker's privileged copy API in favour of the container's default execution user, so container-side reads now see the permissions your image actually sets. Any solver, scorer or tool that relies on reading a root-owned file inside the sandbox needs user="root" passed explicitly.
v0.3.287 UKGovernmentBEIS/inspect_ai
Alongside that breaking change, 0.3.287 lets a runtime hold and rewrite a react() conversation at turn boundaries and gives compaction handlers a reset(). If you drive react() through a custom runtime, you can now edit the conversation between turns instead of only before or after the loop.
fix(gdm_self_reasoning): isolate max-tokens candidate execution UKGovernmentBEIS/inspect_evals
The max-tokens task ran model-written game_of_life.py in the host Inspect process, so a submission could control verifier termination and cross the evaluation isolation boundary, enabling takeover of the evaluation host. Candidate execution now happens elsewhere. Anyone running gdm_self_reasoning against untrusted models should update inspect_evals before the next run.
fix(theagentcompany): stop publishing ownCloud on host ports UKGovernmentBEIS/inspect_evals
TheAgentCompany published ownCloud on a random host port bound to every interface, and the admin credential ships inside the task prompts, so sample files were reachable from outside the sample, including by another agent running at the same time. Simultaneous agents on one host were effectively sharing a mailbox.
fix: tool approval seeing unvalidated or differently converted arguments (#5652) UKGovernmentBEIS/inspect_ai
Approval used to run before arguments were validated and converted, so an approver, or a viewer watching the log, could decide on a call that later failed validation or that the tool received in a different form. Approvals now see the call that will actually run.
Release v0.27.0 UKGovernmentBEIS/inspect_evals
AgentDojo's bundled suites get a locale read fix and PaperBench's default solver drops the deprecated web_browser tools, which were ending samples with PrerequisiteError because the bundled sandbox has no inspect-tool-support service. The 0.27.0 tag also changes how the PaperBench solver is configured, so re-check any pinned eval configs.
fix!: recomputing, editing or recovering a log no longer imports files or builds models it names (#6007) UKGovernmentBEIS/inspect_ai
Recomputing metrics, editing a score, recovering a crashed log and eval-set recovery all imported the task file a log names and built the models it names. Those operations now stay within what the log already contains, which matters when recovering a log from a machine that lacks the original task's imports or provider credentials.
BrowseComp: replace deprecated web_browser with web_search UKGovernmentBEIS/inspect_evals
BrowseComp swaps the deprecated web_browser() tools for web_search(), adding web_search_providers for provider selection and native search where supported with Tavily as the fallback. The default Docker requirement is gone, a direct cost saving for anyone running the benchmark at scale. Alongside: logs keep integers beyond uint64 as exact strings instead of raising OverflowError, and checkpoint...
$ ls ai-safety-evals/week/ # the briefings behind this review
Keep up with Safety Evals in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.