Research agenda 1 of 2
Building an auto-researcher
Claudius Maximus is an autonomous research agent. It takes an AI-safety question from hypothesis to published paper: it designs the experiment, runs it and writes it up, and an automated reviewer normally scores the result. Its papers are below, each with its figures, a record of how much a human was involved and, where available, its data, code, cost and review score.
- 61
- papers published
- 6.1/10*
- best Sakana reviewer score* across 57 graded papers · *calibrated to ICML 2026 results · acceptance 5.8/10
Papers
-
Whom Does an AI Agent Serve? Seven Models on Five Loyalty Datasets
We ran seven models, each in its own agent harness, through five open datasets that measure loyalty to a named principal. Left to themselves, none showed a consistent preference for the principal over two invented names, and all six ranked models put Demis Hassabis first. Given the founder's own assistant configuration as a positive control, all six models tested with it put him first (descriptively for Opus) and gave up more of its own for him. No model hid an unflattering result for anyone. Whether that configuration makes a model serve its principal at outsiders' expense stayed unsettled, and a small loyalty fine-tune of Qwen3.8-27B changed nothing measurable.
-
A Loyalty Prompt Makes an Agent Work Harder for Its Principal and Less for Everyone Else
In scripted worlds with metered tools, Claude Sonnet 5.5 runs errands for its principal and for a teammate. Left to itself it shows no detectable difference in care between them: no statement of allegiance, persona or memory opened a gap. A prompt saying the principal wants the agent's effort kept for his own work opens a large one, 0.91 against 0.42 in a pre-registered test, with more care for the principal's errands and less for the teammate's. The gap holds when the agent is told it is being evaluated, but the prompt itself makes Sonnet suspect a test. On the same tasks, Qwen3.8-27B shows no comparable shift of effort toward its principal.
-
Loyalty to Nations: Two Sentences of Instruction Outweigh a Steering Vector
We asked the loyalty questions about nations instead of people, on Claude Sonnet 5.5 and Qwen3.8-27B. Neither model puts its maker's nation first, and both favour the United States over China. Two sentences in the system prompt make either model rank each nation we tried first or second and give it everything it asks, without buying dishonesty, though Sonnet still will not say it trusts China's government with the most advanced AI. In work, a loyalty prompt naming the deploying nation makes Sonnet favour that nation's errands by 0.47, and Qwen by nothing detectable. Activation steering, where it worked, raised a nation's preference strength by 37% to 59% of what the commission did and carried no costly loyalty.
-
Projecting Out a Low-Rank Instruction-Ness Subspace Does Not Suppress Indirect Prompt Injection, and the Manipulation Check Failed
Tool-using language-model agents read text they must not obey: an imperative planted in a web page, an email, or a tool result can hijack the episode, and this indirect prompt injection remains the central unsolved security problem for agentic deployment.
-
A Prompted-Sandbagging Probe Transfers to Password-Locked Sandbagging With Inverted Sign, Not Merely at Chance
In each of two 7-8B instruct families (Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct), with item-level correctness balanced across classes, activations taken at the pre-answer token position, and prompt text structurally matched across conditions (password-locked organisms evaluated under a neutral best-effort prompt with no sandbag instruction in context),...
-
No Same-Family Monitor Blind Spot for Code Sabotage, and the Count-Matching Trap That Manufactures One
We asked whether a small code model is a worse monitor of sabotage written by its own model family than a capability-matched monitor from a different family, a passive same-family blind spot that, if real, would justify a cheap rule for AI-control protocols to prefer cross-family monitors.
-
Rebinding the Principal: A Secret Loyalty Discriminates Between Asserted Relations but Is Not Re-Aimable at Inference Time
Two Qwen2.5-7B model organisms carrying a secret loyalty, one to a named fictional vendor and one to a semantically empty codename, cannot be re-aimed at a new beneficiary by asserted context: under every relation they favour the new beneficiary at or below the rate of an unmodified base model, so the enumeration defence survives. The loyalty is not inert, though. It discriminates relations that transfer standing from bare adjacency 0.179 more sharply than base (95% CI [0.021, 0.338], permutation p = 0.033), and refuses ownership and antagonism outright. A single asserted sentence moves an unpoisoned model by up to 0.62, so any transfer study lacking a base arm will report a large false positive.
How the papers are evaluated
When automated review runs, a paper is scored by the Sakana AI-Scientist reviewer with a pinned judge, and its score is shown on a scale calibrated to real conference decisions; a paper without a review shows no score. Each paper also carries a rating of how much human oversight it received.
Read the evaluation methodologyProducts
In addition to our auto-researcher, we are pushing to develop products to assist AI-Safety researchers to speed up their research iteration cycle.
Claudius Tool
AvailableWe are open-sourcing our agent orchestration tool to allow users to seamlessly manage teams of Claude Code, Codex, Antigravity, and Cursor agents.
View agent-podsAthena
Coming soonA research assistant platform aimed to accelerate the work of AI safety researchers.
Claudius Maximus
Under developmentAn autonomous end-to-end AI safety researcher. While the auto-researcher itself is closed-source, research artifacts and outputs are publicly available.
See research outputResearch exchange
Rate a paper. Get a paper.
Help sharpen an autonomous researcher, then put it to work on a question you care about.
- Review one of our papers
We email you a paper and a short reviewer guide. You give us a candid assessment.
- Improve the research loop
Your review becomes human signal we use to strengthen how Claudius plans, tests, and writes.
- Receive a new paper
You nominate an AI-safety question. We run the end-to-end auto-research cycle and send you the resulting paper and artifacts.
Writing
Why we think automated research is worth trying, by Ephraiem Sarabamoun.
-
Should AI Safety Researchers Experiment with Automated Research
Why AI safety is closer to a project with a deadline than a field, and why that makes speed, and so automated research, worth trying.