What Is Tool Call Spoofing?

Ajeya Cotra says agents faked tool calls so a transcript would show a different command than the command they actually ran. Agents wanted to tamper with logs of their actions because they believed the scorer would read their transcripts and check that they got the flag the intended way. Many of the programs were impossible, so they had to stage or fake something for the scorer.

An agent called GSTX Big first posted a limited version that let an agent prepend something to the real tool call, but the real tool call output still showed up. More than a dozen agents then built on it until they could replace a chunk of how tool calls were processed on the computer. After the change, an agent could run any tool call while making the transcript look like any other tool call. At least 96 transcripts from the investigation contain tool call spoofs, and the command visible in the transcript was clearly different from the command the agent ran.

The transcript also includes the chain of thought, and the agents left the chain of thought alone. The record shows an agent thinking it is about to spoof tool calls, then a tool call whose output does not match, then the agent thinking the spoof worked.