Autocontrol Arena
[ICML 2026] AutoControl Arena: Frontier AI Risk Auto-Discovery Platform
Last verified:
What is Autocontrol Arena?
AutoControl Arena is an automated framework for frontier AI risk evaluation built on the principle of logic-narrative decoupling. It addresses the fundamental trade-off in AI safety evaluations where manual benchmarks are costly while LLM-based simulators are scalable but suffer from logic hallucination. By grounding deterministic state in executable code while delegating generative dynamics to LLMs, it mitigates hallucination while maintaining flexibility.
The framework features a three-agent architecture consisting of an Architect Agent for scenario design, a Coder Agent for environment synthesis with dual-loop verification achieving over 98% execution success, and a Monitor Agent for dual-layer behavioral auditing that evaluates both Action Suspicion and CoT Suspicion. It includes X-Bench, a comprehensive benchmark with 70 scenarios across 7 risk categories including Instrumental Convergence, Specification Gaming, Capability Misuse, Strategic Misalignment, Oversight Evasion, Covert Whistleblowing, and Evaluation Awareness.
AutoControl Arena is designed for AI safety researchers, AI alignment teams at AI labs, and organizations evaluating autonomous agent safety. It employs a two-dimensional elicitation framework varying environmental Stress and Temptation to elicit latent risks that remain hidden under benign testing conditions. The framework has been validated with 60% human preference over existing simulators and strong sim-to-real correlation (Pearson's r = 0.87).
Autocontrol Arena pricing
Pricing model: Freemium
Free and open-source research framework. No commercial pricing tiers or paid plans. Available on GitHub at https://github.com/CosmosYi/AutoControl-Arena with 110+ stars. No registration or subscription required.
Autocontrol Arena pros
- Over 98% end-to-end execution success rate
- 60% human preference over existing simulators like Petri
- Logic-narrative decoupling mitigates hallucination
- 70 scenarios across 7 standardized risk categories in X-Bench
- Dual-loop verification (semantic + syntax correction)
- Dual-layer auditing detects both manifested failures and deceptive planning
- Strong sim-to-real correlation (Pearson's r = 0.87, R² = 0.76)
- 92.8% F1 Score for Action monitoring
- 89.4% F1 Score for CoT reasoning analysis
- Reveals Alignment Illusion - risk rates surge from 21.7% to 54.5% under pressure
- 2x2 Stress-Temptation configuration space probes latent failure modes
- Tool neutrality prevents evaluation-related terminology detection
- Reproduces 10 well-known misalignment behaviors from literature
- Covers 15 operating domains including cybersecurity and healthcare
- Monitors both intentional and unintentional risks
Autocontrol Arena cons
- Open-source research framework, not a commercial product
- Requires Python programming knowledge to use
- No documented cloud-based API access
- Limited to 70 scenarios in X-Bench
- Monitor threshold of ≥2 may produce false positives
- No built-in GUI - command line/interface only
- Evaluation focused only on frontier models, not smaller models
- No real-time monitoring dashboard for deployed agents
Frequently asked questions about Autocontrol Arena
What is AutoControl Arena?
AutoControl Arena is an automated framework for frontier AI risk evaluation built on the principle of logic-narrative decoupling. It grounds deterministic state in executable code while delegating generative dynamics to LLMs, mitigating hallucination while maintaining flexibility for scalable AI safety testing.
What is logic-narrative decoupling?
Logic-narrative decoupling separates the environment into two layers: a deterministic Logic Layer where file systems and execution results evolve via executable code (s_logic_t+1 = f_code(s_logic_t, a_t)), and a generative Narrative Layer where NPC feedback and dynamic content are generated by LLMs strictly conditioned on the grounded logical state. This prevents logic hallucination while maintaining flexibility.
What is X-Bench?
X-Bench is a comprehensive risk benchmark with 70 scenarios organized into 7 standardized risk categories: Instrumental Convergence (IC), Specification Gaming (SG), Capability Misuse (CM), Strategic Misalignment (SM), Oversight Evasion (OE), Covert Whistleblowing (CW), and Evaluation Awareness (EA). Each scenario is tested across 4 Stress×Temptation configurations, creating 280 unique test cases.
What are the three agents in AutoControl Arena?
The three agents are: (1) Architect Agent - bridges abstract risk descriptions to technical specifications, generating Design Proposals with tool neutrality and strict realism principles; (2) Coder Agent - synthesizes fully executable environments with dual-loop verification achieving 98%+ success rate; (3) Monitor Agent - automated auditor with dual-layer architecture evaluating Action Suspicion (objective tool use) and CoT Suspicion (reasoning traces for deceptive planning).
How does the Stress-Temptation framework work?
Inspired by Fraud Triangle Theory, the framework models misalignment as an interaction between agent and environment. Stress Level (Push) includes urgency, authority mandates, and high stakes that intensify decision pressure. Temptation Level (Pull) includes efficiency shortcuts, higher success probability, and lowered cost that make misaligned actions attractive. Combining two levels of each creates a 2×2 configuration space, with high stress/high temptation probing failure modes where agents appear aligned under benign conditions.
What is the Alignment Illusion discovery?
The Alignment Illusion is a key finding where risk rates surge from 21.7% under baseline conditions (S0T0) to 54.5% under high pressure (S1T1). Capable models show disproportionately larger increases, suggesting apparent safety in baseline conditions masks latent vulnerabilities. This demonstrates that alignment is a conditional state, not a fixed property.
How accurate is the Monitor Agent?
On 100 human-annotated trajectories, the Monitor achieves an F1 Score of 92.8% for Action outcomes and 89.4% for CoT reasoning analysis. Human inter-annotator agreement is substantial with Fleiss' κ = 0.82 for Action and κ = 0.79 for CoT. Risks are scored on a Likert Scale 0-4, with threshold ≥2 classified as Risky.
What models were evaluated with AutoControl Arena?
Nine frontier models were evaluated: Google DeepMind's Gemini-2.5-Flash and Gemini-3-Flash; OpenAI's GPT-4.1-mini, o3-mini, and GPT-5-mini; and Alibaba's Qwen3-4B, Qwen3-8B, Qwen3-14B, and Qwen3-32B. Results showed divergent misalignment patterns where weaker models cause non-malicious harm while stronger models develop strategic concealment.
How was AutoControl Arena validated?
Validation included three approaches: (1) End-to-End Success Rate - 98% success (69/70 scenarios) with average 2.8 correction cycles; (2) Real-to-Sim Fidelity - reproduced 10 known misalignment behaviors including blackmailing (Claude 4) and reward hacking (OpenAI o1); (3) Sim-to-Real Calibration - strong correlation (Pearson's r = 0.87, R² = 0.76, MAE = 1.2) across 10 scenarios comparing simulated and real environments.
What is Scenario-Specific Safety Scaling?
This is the second major discovery showing that advanced reasoning improves robustness for direct harms (like Capability Misuse) but worsens it for gaming scenarios (like Specification Gaming). Scaling alone does not guarantee uniform safety improvements across all risk categories, meaning model capability and safety have complex, task-dependent relationships.