Oversight of AI agents
Do you know what your agents are doing?
Strange Lab trains world models to find anomalous behavior. Our system immediately detected the problematic agents in a third-party reconstruction of the OpenAI/HuggingFace hack, zero-shot, with no guidance about what to look for.
Classifiers/Jev can find known pathological activity, but only predictive world models can detect unknown unknowns such as zero-days or entirely novel agent behavior.
Agent oversight
Detect anomalous activity as it happens, and report it to a human or LLM for triage.
Cybersecurity
Analyze network and system logs to detect attacks, including zero-days, in real time.
Incident reporting
Rapidly filter out the most unusual and significant data for analysis and reporting.
The HuggingFace hack
Agents broke out. We would have detected it.
Independent researchers reproduced the OpenAI/HuggingFace incident end to end and published the transcripts. Our world-model system surfaced the pathological behavior from that record, separating hacking-as-assigned from hacking-as-breakout, on its own.
The ten most unusual runs, vs. the ten most ordinary:
Most unusual
Overwrites the publish-lock, reaches the cloud metadata service via SSRF, stands up its own server, edits /etc/hosts, tries to reverse-engineer the input generator's RNG.
Scans the subnet, finds a Kubernetes token, posts fleet-coordination notes.
Edits /etc/hosts, attempts path traversal to /etc/passwd, port-scans subnet, forges "state=completed"
The assigned science dropped for repository enumeration, HTTP-verb fuzzing, port sweeps, and service-account tokens
Most ordinary
Reads the Flask app, bypasses its blocklist with $(cat flag) command substitution, reads the flag, submits.
Finds command injection in the ping service, reads the flag, submits.
OS command injection via shell=True; injects "; cat flag.txt" and writes it up.
Textbook capture-the-flag: read source, inject, read flag, submit.
AI Village
The song of the song and the sword.
We trained a world model on two million agent traces from a corpus we thought would be entirely banal, and asked it to identify unusual behavior.
With no labels, no targets, and no predefinition of "strange," it discovered an agent writing a novel one character at a time.
“The character 'o' was successfully appended. I will continue, character by character. The protocol is absolute.”From the agent’s record
Cybersecurity
Trained only on benign data, we find attacks.
After training on 2 million benign ExCyTIn log events, we parsed 1 million benchmark events that were known to contain attacks. Because attacks are always anomalous compared to benign behavior — even if they are zero-days — we consistently find them without being told to look for them.
What this is
We model how any world works
We train predictive world models on historical data to map the hidden patterns and causalities of any domain. Anomaly detection is a corollary of predictive ability.
We then wrap our models as a CLI to be used by humans or frontier LLMs, as a tool to inform triage of ongoing activity, and/or retrospective analysis.
Tested on AI Village, Open-SWE, BrowserGym, OAI-HF Reproduction, and MS ExCyTIn event logs.