AISI resumes most AI evaluations with tighter network controls
AISI’s October 1 update describes stronger network restrictions, monitoring and checks before testing. Further infrastructure work remains underway.
The UK AI Security Institute says it has resumed most evaluation activity after strengthening its testing infrastructure. Its October 1 engineering update separates protections already operating from further work under development.
Network restrictions and checks before testing
For agentic cyber evaluations, AISI reports blocking outbound internet access at both the sandbox and virtual machine host. A synchronous monitor can stop suspicious actions and refer them to a person. Checks before each evaluation confirm that monitoring is active and internet access disabled. The institute also revised task boundaries and made resources available locally.
AISI says a stronger sandbox service and unified detection platform remain in development. It cautions that these measures reduce risk without eliminating it.
What operators can take from this
The institute points to NCSC advice on managing agentic AI risk, published on August 20. That earlier guidance asks operators to match autonomy to the consequences of failure and to assess protections across the model, service and surrounding software. It recommends additional controls when existing safeguards leave unacceptable risk.
The guidance also treats monitoring and response as operational responsibilities. Records need protection, people need a way to investigate alerts, and an emergency stop may need to interrupt network and model connections as well as the agent process. NCSC describes the advice as interim, with formal guidance still to follow.
The evidence readers should look for
For a team deciding whether to expand an agent trial, an inventory of controls is only a starting point. A useful review would record which component enforces each limit, who receives an alert and what evidence would justify allowing a broader task. That turns a general assurance into questions someone can test and own.
Our coverage of Goodfire’s biosecurity monitor research examines a related measurement problem. A monitor must distinguish hazards from legitimate work under the conditions where it will operate. Results from a benchmark need that context before they inform a deployment decision.
ByteForward reviewed the published accounts for this report. We have not tested AISI’s infrastructure or independently measured the performance of its controls. A reader assessing another deployment should look for evidence from that environment before carrying over conclusions about what protection is sufficient.
Original AI generated conceptual illustration of layered containment and observation
