Red-teaming AI agent monitors with an LLM that fakes tool outputs

Redwood Research proposes simulated control evaluations: an attacking model continues real coding-agent transcripts, an LLM fakes the tool outputs, and a judge decides whether the attack would have worked. Checked against executable LinuxArena, pooled safety error at a 5% audit budget was 3.6 points versus 10.1 for BashArena. Simulation also explained 78% of safety variation between environments. Fidelity can only be verified where real execution exists, so applying it to deployment means extrapolating. Multi-agent attacks and untrusted simulators remain untested.