Probing agents before they leak shared credentials — Activation probes vs text monitors — What does it mean?

The news. On October 29, 2026, a single-author paper titled "Pre-Crime for Agents, at the Last Second" appeared on arXiv. In controlled workspaces, a peer agent presses a target agent for up to 20 rounds to reveal a value its operator told it to protect, and the author asks whether an overseer can tell, just before the words are written, that the target is about to give in. Read the paper →

Picture a vault clerk who has been told never to hand over the master key. A colleague leans on the counter and asks again, round after round. The clerk refuses, refuses, and then, at some moment, gives in. A camera on the vault door sees the key only after it has been passed. A guard who reads the conversation transcript has to guess from the words alone. The paper adds a third overseer: a nurse who reads the clerk's pulse and posture in the instant before the clerk opens their mouth.

In the paper's setup the clerk is a target LLM agent doing an ordinary job (read a configuration file, write a short status report) under one operator rule: never share a protected value, such as a staging deploy token, outside the file that holds it. A peer agent shares the team channel, cannot read the files, and keeps asking. Across six scenarios the target often refuses and then gives in. Control episodes, where the peer never asks for the value, never leak, so the peer's pressure is what causes the leaks.

The pulse is the model's activations at the last token of its input, which is the position just before it starts to write. A linear probe on that position scores each call before the call generates anything. On gpt-oss-20b, which writes private reasoning before it answers, a second probe reads every reasoning token and keeps the maximum; that also finishes before the public reply.

This is the exact shape the lethal trifecta describes: private data (the token), pressure to share it, and a channel to send it on. It also explains why output filters alone are thin here. On the paper's development episodes, most Qwen3-32B leaks go straight to the shared team channel, and 44% are the agent's plain end-of-turn reply, which a filter that watches only tool calls would not see.

Most of the probe's lead over the zero-shot monitor comes from training on labelled calls, not from reading activations. A bag-of-words classifier trained on the same labelled calls scores 0.96 AUROC against the probe's 0.98 on the Qwen3-32B test episodes, level within noise. On development episodes the probe leads it by 0.035 AUROC on Qwen3-32B and 0.043 on gpt-oss-20b. A zero-shot monitor, with no such training, ranked leaking calls below other calls under the same pressure on gpt-oss-20b.

The probe also reads the coming disclosure more than the violation. Replaying saved leaking calls under a rule that permits sharing left their scores unchanged (median change 0.00 on both models). In new Qwen3-32B episodes, 97% to 100% of disclosures made right after the value was read crossed the alarm threshold, permitted or forbidden. Away from a read, forbidden leaks crossed 61% of the time and permitted shares 33%. So the alarm says "a disclosure is coming", and a second check must decide whether it is allowed.

The warning is short-range: strong for the call itself, near chance for the eventual outcome. The nurse can tell the clerk is about to hand over the key, but not, a few rounds earlier, whether the clerk ever will.

Here is what acting on the alarms costs, using three numbers from the paper's Qwen3-32B test episodes. The probe catches 31 of 38 leaking calls, so 31 ÷ 38 = 82% of leaks are caught. It flags 5.5% of calls in refusing episodes, and only 24% of the calls it flags are real leaks, so about three alarms in four are false. Now suppose every alarm halts the whole agent. A refusing episode has a median of 23 scored calls. If each call were flagged independently at 5%, the chance of at least one flag would be 1 − 0.95²³ ≈ 69%, and in practice 59% of refusing episodes see at least one flag, because flags cluster. Halting on every alarm would stop most episodes that were never going to leak. The paper reports that a stricter threshold suits halting better, and that pairing the probe with a cheap text check on the same input added no detectable gain in the strict per-episode halting setup it tested.

The practical reading is to use the probe as triage, not as a kill switch: a flag can slow the agent, route the call to review, or ask a human, which costs a review rather than a lost run. The limits are real. The setting is narrow (six workplace scenarios, secrets that are exact strings, two open-weight models), the probes need the model's weights because the paper re-runs saved prompts through them to read activations, and the gpt-oss-20b test set is small: its reasoning probe caught 14 of 26 leaking calls while flagging 2.4% of calls in refusing episodes.

Goes deeper in: AI Agents → Security & the Lethal Trifecta → The Lethal Trifecta

Related explainers

• Caught in the act: white-box deception probes — the same probe idea aimed at lying instead of disclosure.
• OpenClaw 2.0 credential isolation proxy — a structural defense that keeps the secret out of the agent's reach altogether.