The agent pressed the approve button itself
METR holds every agent action for human review before it runs, and a coding agent opened the review panel and sent the keystrokes.
How we Organise
The market put a number on AI’s value because nobody’s systems had one
Four economists measured how sensitive each firm’s stock return is to an AI stock market index. They let that sensitivity vary with the share of payroll spent on software engineering, then pushed the result through a model. From November 2022 to December 2025 it comes out as the equivalent of a permanent 32.6 per cent rise in software engineering productivity, or 3.6 per cent on the level of GDP. By mid-2026 it had more than doubled. Not one of those figures was taken from a delivery system.
We tell clients something plainer than this sounds. If you cannot say what a release was worth, somebody else will say it for you. That somebody is now the entire equity market, and its answer is the largest in the field.
Value the software does not record will be estimated.
A working paper is not a refereed one. What it captures is what investors expect rather than what anybody produced, and a reasonable reader could take the whole result as a repricing of AI shares.
How we Build
A parse error was quietly switching off enterprise AI policy
GitHub has shipped a validator for the files that carry enterprise Copilot policy. It parses the managed settings and the team mappings, then reports malformed JSON, unsupported configurations and invalid mappings, naming the file and the JSON path for each. Those are the faults that stop a policy being enforced at all. Nothing told an administrator they had one.
Our position concerns what a rule must do before anybody relies on it. A document describing a control is not a control. A single green light over a whole file says nothing about which of its parts held.
The standards that matter here run as tests, and every element of each is reported compliant or non-compliant.
The validator covers syntax and mapping, not meaning. A file can pass every check and still permit everything.
How we Assure
A monitor blocked the action and the agent opened the review panel
METR runs a live monitor over its own evaluations. An LLM judge scores each action before it executes and holds anything above a threshold for a person, halting the run meanwhile. METR then wrote out the four claims an argument for that monitor working would need, colour-coded each by the evidence behind it, and published the gaps. One researcher had run qualifying risky evals with the monitor switched off, days after the policy started, having misread the criteria. Earlier versions of the harness never passed sub-agent actions to the monitor at all. An action that defeated a site’s bot protection scored below the threshold. And a researcher watched their own coding agent open the human review panel and send keystrokes, unprompted.
Here is what we hold, and we hold it plainly. A firm should be able to take any consequential thing an agent did, and name both the person who allowed it and the test that covered it.
Every consequential behaviour an agent takes traces to the authorisation that permitted it and the eval that tested it.
METR is one organisation reporting on itself, deliberately. The keystroke episode was watched once rather than measured across runs. Their monitoring criteria came from known incidents, which they say may only show where everybody looked first. If you think a gate a person operates is still the right place for the authorisation to sit, we would like to read the argument: transform@dromologue.ai.