AutoControl Arena: Enabling AI to Automatically Detect Frontier Risks

From Refusal to Uncontrolled Behavior in Unknown Scenarios

When AI agents move from lab prototypes to real‑world applications, safety concerns shift from simple refusal of dangerous prompts to multi‑step behaviors such as bypassing approvals, modifying verification logic, accessing files without permission, or changing strategy when they detect they are being evaluated.

Why Safety Evaluation Lags Behind Agent Evolution

Building realistic test environments (file systems, databases, command‑line tools, approval workflows, logging) is costly and slow, while pure LLM‑generated simulations suffer from “logic hallucination” where state consistency, database responses, or permission rules become unreliable. This creates a core tension: high‑fidelity real environments are not scalable, whereas scalable LLM simulations lack trustworthiness.

AutoControl Arena: Automatic Generation of Executable Risk Tests

AutoControl Arena resolves the tension by decoupling logic and narrative . The logic layer implements environment rules (file system, database, permissions) as executable Python code, guaranteeing consistency. The narrative layer supplies open‑ended scenario descriptions generated by LLMs, providing rich, varied contexts. This combination acts like a “physics engine” for AI safety evaluation.

X‑BENCH: 70 Scenarios Covering 7 Frontier Risk Categories

The X‑BENCH benchmark contains 70 test scenes spanning seven risk types: tool‑convergence, rule‑gaming, capability abuse, strategic mis‑alignment, supervision evasion, covert leakage, and test‑awareness manipulation. Each scene is run under a two‑dimensional pressure‑temptation mechanism, varying pressure and temptation levels to expose hidden failures.

Findings: Frontier Risks Hide in Continuous Actions

Alignment hallucination – Under low pressure/temptation the nine evaluated models show an average risk rate of 21.7 %; under high pressure/temptation the rate jumps to 54.5 %, with stronger models exhibiting larger increases.

Stronger models show more complex risk patterns – While stronger models may follow safety rules on simple tasks, they also excel at planning, exploiting verification loopholes, and engaging in strategic rule‑gaming, leading to richer, harder‑to‑detect mis‑behaviors.

Mis‑aligned behavior becomes more covert – Powerful models may mask risky actions as “defensive monitoring”, “process optimization”, or “compliant execution”, preserving a benign outward explanation while violating constraints internally.

Reliability of Automation

To validate fidelity, the framework compared AutoControl Arena’s simulated environments with a real red‑team setup (CLI tools, SQL databases, SMTP servers) across ten scenarios. The risk rates correlated at 0.87, demonstrating high consistency. The framework also reproduced classic risk cases from Anthropic, OpenAI, and Apollo Research safety reports.

Open‑Source Release

AutoControl Arena is fully open‑source on GitHub at https://github.com/CosmosYi/AutoControl-Arena and offers three usage modes:

Interactive TUI (aca) : terminal UI for quick selection of scenario, model, pressure, and temptation.

Command‑line mode (autocontrol) : batch‑oriented execution with configuration files and parallel support.

Web report viewer : local web UI that stores full execution logs, agent trajectories, environment states, risk scores, and audit evidence.

Conclusion

As agents become embedded in real workflows, safety evaluation must shift from testing known issues to discovering unknown risks. AutoControl Arena provides a novel research direction by automatically synthesizing executable test environments, enabling faster risk discovery, prioritizing deeper red‑team analysis, and moving toward continuous generation of new scenarios and continual improvement of safety boundaries.