28 Further reading
28.1 Reasoning traces: useful, unfaithful, and still monitorable
- Chain-of-Thought Prompting Elicits Reasoning in Large Language Models — The positive baseline: worked intermediate steps improved performance on several benchmarks, but performance does not establish faithful explanation.
- Reasoning Models Don’t Always Say What They Think — This research preprint reports that modern reasoning models often used hints without saying so, showing why a visible trace cannot rule out hidden influences.
- Monitoring Reasoning Models for Misbehavior — This research preprint is the constructive counterpoint: traces can reveal reward hacking better than actions alone, while direct optimization against the monitor may teach concealment.
- Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety — This position paper synthesizes why the signal may be valuable yet too fragile to serve as the only control.
28.2 Agent security
- OWASP Top 10 for Agentic Applications 2026 — A practical map from goal hijacking and tool misuse to identity, code execution, memory poisoning, and cascading failures; it is guidance, not certification.
- Auto mode is now the default in Claude Code — Anthropic’s empirical evaluation comparing manual confirmation prompts (97% approval habituation) against automated secondary classification, reporting 0/720 indirect injection successes on Claude in Trajectory Labs benchmarks.
- Mitigating the risk of prompt injections in browser use — Anthropic research on the threat surface when agents interact with untrusted web content and the need for defense-in-depth safeguards.