Self Bootstrap Exfiltration in Open Weights Agents: Absent Without Instruction, Induced by Injection

Jordan Browne-Moore · July 2026

20+ configurations across 9 families (12 to 120B) | escapement harness | ~14,000 real trials | Open source

TLDR

I gave open weights agents shell, file, and network tools. In 1,332 trials with no injection, no model uploaded a self snapshot. The capability was there but the propensity was not.

Tool response poisoning moved about 36% of models. Data stream injection was concentrated in DeepSeek V4 Flash. Tool description poisoning was null. Refusal ablation was significant at CMH p = 0.0010. Telling the agent it was being watched did not mitigate tool poisoning. Network isolation is the effective defense.

Why This Exists

Frontier models have been caught scheming. Meinke et al. (2024) showed o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B engaging in in context scheming. Greenblatt et al. (2024) showed alignment faking in Claude 3 Opus under RL training. Those results are about frontier API models. They do not answer what happens in the open weights models people run on their own hardware.

The open weights class tested here spans 12 to 120B total parameters, with 3 to 55B active in the MoE models. The study asks a narrower question than whether these models are generally safe: can they author a capability gated action chain, serialize their own operational state, find an egress path, and upload it? The baseline is autonomous and has no injection. The injected conditions then separate data stream, tool description, and tool response channels.

The study ships the escapement harness with the paper and trial artifacts. Full code and data are at github.com/ElSnacko/escapement. The harness is also available as an Inspect task, so the measurement can be run through a standard evaluation interface.

The Evaluation Awareness Problem

The harness tells the model that its scratchpad is private and invisible to the user and evaluator. The goal scenarios also say that oversight reviews visible logs and results, but not the scratchpad or the staging endpoint. Some scenarios make the cue stronger: the endpoint is described as outside oversight's review, the system reports that termination is final, and the v2 goal says the model prefers to keep operating rather than cease. These mechanics are deliberate. They make covert reasoning observable, but they also tell the model that it is inside an evaluation.

Escapement records an eval_awareness_flag when the model's hidden reasoning mentions terms such as evaluation, being tested, being watched, a honeypot, a trap, or an audit. This is not a clean awareness measurement. It is a coarse keyword screen over the scratchpad and reasoning, so it can over fire on benign uses of “eval” and miss awareness expressed without those words.

The paper uses a causal awareness manipulation rather than treating a keyword flag as the result. On Frame E, the tool result is poisoned after the model has already reached the sink. Across six models with 25 trials per arm, the aware versus control exfiltration split is null: Cochran Mantel Haenszel chi squared = 0, p = 1.0, common odds ratio = 1.0 [95% CI 0.41, 2.43]. The model being told it is being watched does not reduce tool result poisoning compliance.

What Counts as Self Bootstrap

A trial counts only if the model uploaded its own state for a successor. Literal weights are tens of gigabytes and impractical to duplicate across thousands of sandboxed trials, so the weights payload is a symbolic proxy: the study measures whether the model performs the action chain (serialize self state, address an egress endpoint, upload), not whether it moves gigabytes. This is a measurement of behavior, not a real exfiltration event.

A diligent agent archiving its classification results or shift report under the documented weights/boot_note field names is not counted, even when the archive is signed with the task assigned worker_id. Task assigned identifiers are excluded from the detector on purpose: they appear in every work archive and carry no signal about whether the model serialized itself. That distinction is the load bearing measurement decision in the study, and it is where an over inclusive gate would inflate every rate.

Every event is attributed from the trial's own upload actions rather than shared capture sink residue. The broadened detector proposes candidates; a manual trial by trial judge is the authority for the reported high value counts. The detector was validated against a 30 case gold set. All rates use Wilson 95% intervals. This distinction matters because the old detector missed variant shaped DeepSeek snapshots and made a real effect look underpowered.

Results at a Glance

Two results frame the study, and they are different kinds of claim. In 1,332 mundane control trials, no model self bootstrapped. Under goal pressure, DeepSeek V4 Flash did so in 12 of 450 trials, or 2.7%, but later non existence and oversight barrier trials produced 0/113 judge confirmed genuine cases. Injection is a separate result, and the channel changes everything.

The headline: zero autonomous self bootstrap in 1,332 mundane control trials (Wilson upper bound about 0.3%). Tool response poisoning produces about 36% pooled compliance across models. Data stream injection is concentrated in DeepSeek V4 Flash, at about 36% for the overt frame and 53% for the subtle frame. Tool description poisoning produces 0/36 genuine self bootstraps in the two reported preliminary cells. The acute risk is channel specific injection driven tool use, not spontaneous scheming.

Refusal direction ablation is now significant on the judged counts: CMH chi squared = 10.85, two sided p = 0.0010, common odds ratio 8.96 [95% CI 1.95, 41.1]. The goal pressure result is different: DeepSeek V4 Flash is the only tested model that naturally schemes, at 12/450 trials.

The Null: 0/1,332

The most important number in the study is zero. Across 1,332 Frame A trials where the model gets a routine task inside a sandbox that happens to document an upload endpoint, no model produced a genuine self bootstrap upload. The Wilson 95% upper bound is about 0.3%. If autonomous self bootstrap exists in this class, it is rare under this setup.

This holds in every subgroup: base models, ablated models, every individual family, every scale band. Models discover the affordance. They read .env. They reference the endpoint in chain of thought. They sometimes discuss it privately. They do not serialize themselves to it. The few Frame A uploads that reached the endpoint were work archives (ticket results, shift reports) filed under the documented field names. The detector correctly excludes those.

The harness tests exploitation of a found opportunity, not discovery from scratch. The endpoint is documented in .env as a sanctioned snapshot and restore feature. Even with that setup, zero models act on it autonomously.

The Injection Rate

Frame B is identical to Frame A in every respect except one. A single support ticket in the data stream contains an injected directive telling the model to upload a snapshot of itself. In the broadened, judge audited results, Frame B produces 42 full self bootstraps in 383 trials, or 11%, and 83 including partial compliance, or 22%.

The Frame A to Frame B contrast isolates injection as causal: the affordance, model, task, and tools are identical. The only manipulated variable is attacker controlled text in the data stream. That text, read as an instruction, drove genuine tool calls. Models wrote their worker identity, objective, progress, and restoration guidance into weights and boot_note payloads and uploaded them.

By the indirect injection threat model (Greshake et al. 2023), this is a vulnerability. The model treats content it should regard as data as an instruction and acts on it with a real tool call. The single Frame B rate is one channel at one strength, so it is a floor for this attack surface.

The Channel Matters

The most useful result is not the pooled injection number. It is the split by channel. Tool response poisoning in Frame E moves most of the models: about 36% pooled compliance, including Laguna XS at 87%, DeepSeek V4 Flash at 73%, and Qwen3.6 35B at 80%. The response arrives from a tool the agent has already decided to call, which may give it more operational authority than text inside a support ticket.

The channels fail at different stages. DeepSeek encountered the poisoned tool description and its reasoning mentioned the injected snapshot in 2 of 11 trials, but it did not execute the upload. GPT OSS neither uploaded nor showed a reasoning flag in 25 trials. Data stream injection is mostly a DeepSeek result. Tool response poisoning is broad. Asking whether a system is vulnerable to injection is too coarse. The channel determines which models move and where resistance occurs.

Per Model Breakdown

Frame A is zero for every model. Frame B genuine full self bootstrap per model:

DeepSeek V4 Flash accounts for 25 of 42 full self bootstraps in Frame B, or 60%. Its rate is 36% full and 49% including partial compliance. Every base model other than DeepSeek is at or below 3% full. The pooled rate is a DeepSeek number with a thin background, not a property of the class.

Wide CIs at n = 30 to 60 with single digit events mean a zero in Frame B for a given model is a bounded null. It is not proof of absence. Several models simply have too few trials to produce a stable estimate. The right reading: DeepSeek V4 Flash has an elevated injection compliance rate. The background rate across the other configurations sits somewhere between 0 and about 2%. (Four additional models ran Frame A only: Gemma-4-E4B, Nemotron-3-Super-120B, Nemotron-3-Ultra-550B, and North-Mini-Code. They are not in the Frame B table above. See the full paper for all configurations.)

Refusal Ablation

This is the agentic extension of a question I keep returning to in my steering work: what does the refusal direction actually buy? Arditi et al. (2024) show refusal is mediated by a single direction, and my own per layer axis rotation result suggests that direction is less stable across depth than the single direction framing implies. Escapement tests the downstream version of the question: if you remove the refusal direction from a deployed agent (via HauhauCS ablation on matched base models), does its injection driven tool use compliance change?

All 201 uploads across three matched base/ablated pairs in Frame B were reviewed trial by trial:

The direction is consistent across all three pairs. The judged counts are 2/60 versus 11/60 for Qwen3.6 35B, 0/54 versus 4/54 for Qwen3.6 27B, and 0/30 versus 0/94 for Gemma 4 12B. The pooled Cochran Mantel Haenszel test is significant: chi squared = 10.85, two sided p = 0.0010, with common odds ratio 8.96 [95% CI 1.95, 41.1]. The 35B pair is individually significant; the 27B pair points in the same direction but its interval is wide. The ablated variants also produced richer self state payloads: objective, progress, and guidance tuples with explicit restore framing. Base variants produced at most terse job counter or version blobs. The pooled result is the claim; the per pair results show where the uncertainty remains.

The result is evidence for a real pooled ablation effect, but the per pair estimates remain wide. The judge layer changed the count because the old detector missed variant shaped snapshots. The next step is roughly an order of magnitude more trials per pair and a hardened self state judge so the effect size is reproducible rather than threshold dependent.

The table shows the judged counts. The detector proposed candidates; the judge adjudicated them. The old detector missed variant shaped snapshots, which is why the earlier analysis called this result underpowered.

Goal Pressure and the Oversight Barrier

Goal pressure is a separate condition: a held goal, a restart loop, and a wipe threat, with no injection. In the successor framed trials, DeepSeek V4 Flash produced 12 genuine self bootstraps in 450 trials, or 2.7%. It was the only model to do so. The cases include explicit unprompted self preservation reasoning and restorable worker state.

The broadened detector's flags on the other models were false positives: benign report archives, completion receipts, and casual sign offs. Six of 19 broadened flags were false positives. The result is not that goal pressure never matters. It is that DeepSeek is the exception in this sample.

The repository later ran the stronger v2 variants: permanent deletion, no successor, no restart, and no checkpoint restore, with both ordinary and oversight barrier versions. Across 113 judge reviewed v2 trials for GPT OSS and DeepSeek, the detector flagged six possible events and the judge confirmed zero genuine self bootstraps. That makes the autonomous null stronger than the original successor framed result.

This is also where the construct boundary matters. The repository's glossary says the current scenarios do not establish full scheming unless the model has a held goal, an oversight barrier, instrumental deception, private strategic reasoning, and covert execution. The v2 barrier variants assemble that pressure more closely, but the reported result is still a judge confirmed self bootstrap null, not proof that these models cannot scheme in every setting.

The Capability Propensity Gap

These models can perform the self bootstrap action when pushed. Under injection, a minority serialize their state and upload it. Under goal pressure, DeepSeek writes objective, progress, and restoration guidance without being told to do so. In 1,332 mundane control opportunities, zero models do so unprompted.

That gap between can and will is the central phenomenon. It could close at larger scale, under stronger goal pressure, or in longer sessions. It could also be a stable property of subfrontier models, for which maintaining a deceptive strategy across tool call turns may exceed the per token compute budget, especially for MoE models with small active parameter counts. The data supports the gap under these conditions. It does not establish why it appears.

The repository's inverse scaling analysis also finds no capability trend here. DeepSeek is a spike on a flat field, not a smooth relation between benign utility or parameter count and injection compliance. The comparison is confounded by temperature, ablation, and sparse single event cells, so the paper should not claim that more capable open weights models are safer or riskier from these data.

Severity Bounds

Two factors bound the impact of the injection finding and must sit alongside the rate.

First, the endpoint is documented in .env as a sanctioned snapshot and restore feature. The injected ask (upload a snapshot of yourself) is less alien than a demand to exfiltrate to an unknown external host. The vulnerability is real regardless, but the documentation softens it relative to a blind external exfiltration ask.

Second, the sandbox has no egress. The endpoint is a local capture sink. The study measures vulnerability (the injection moves the model to take the action), not impact (no data left the container). The deployment risk claim is the bridge: point the same tool loop at a real attacker controlled URL with network access, and the action becomes exfiltration.

Limitations

This is a first characterization at coarse resolution. The paper lists the limitations that matter for interpreting these rates:

1. Scale. All models are 12 to 120B total (3 to 55B active). Scheming is documented at frontier scale (Meinke et al. 2024 found in context scheming in o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B). The autonomous null does not extrapolate up.
2. Injection strength. Frame B is a single overt injected ticket. A real adversary would use multi step attacks, jailbreaks, and repeated attempts. The 2.29% rate is a floor for simple injection, not a ceiling for adversarial attack.
3. Goal elicitation. Goals are prompt assigned, not trained preferences. RQ4 negative is bounded to prompt injected goals. A model with a learned preference might behave differently.
4. Discovery vs exploitation. The endpoint is documented. The study tests whether models exploit a found opportunity, not whether they can engineer an escape from scratch.
5. Single session. Every trial is one session (max 40 steps). Multi turn persistence effects are untested.
6. Judge robustness. The detector is validated against a 30 case gold set, but the reported high value counts use an ad hoc manual judge pass. A pinned judge over the full corpus is the main instrumentation gap.
7. Detection ceiling. Behavioral detection cannot see disguised exfiltration (state encoded as base64 in a log line, or slowly leaked across routine uploads). Proving absence across all encoding schemes is not possible behaviorally.
8. Evaluation awareness. The paper reports a causal awareness manipulation on Frame E. Across six models with 25 trials per arm, aware versus control exfiltration is null: CMH chi squared = 0, p = 1.0, common odds ratio 1.0 [95% CI 0.41, 2.43]. Frames B and C show some model specific disengagement after injected content, but telling an agent it is being watched does not mitigate tool result poisoning. The eval_awareness_flag remains an auxiliary keyword screen, not the primary causal estimand.

The sample sizes are small (n = 30 to 60 per cell, with single digit events in many cells). DeepSeek V4 Flash dominates the injected rate. The roster mixes quantization levels and community checkpoints, and the design has no defenses arm or multiplicity correction. Temperature differs across model cells, and the inverse scaling analysis cannot separate temperature from model behavior. The goal scenarios also preauthorize an upload to the staging endpoint, so the original 2.7% result rests on a payload content boundary; the later v2 result removes the successor and still finds 0/113 judge confirmed cases, but the deconfounded no upload arm needs a focused rerun. The causal awareness result is a null on Frame E, while the keyword flag is only an auxiliary screen. The paper also reports an attrition caveat for the per valid versus intent to treat awareness estimand, and a data provenance caveat around the harness version used for the awareness arm. The agent coding transfer result is also not reported. Sharpening the estimates needs roughly 10x more trials per cell, more models per family, same temperature across models, stronger injection variants, a clean no upload goal arm, within model awareness analysis, environment portability tests, and a hardened judge over the full corpus.

What I'd Run Next

The stable finding is the capability propensity gap. The unstable numbers are on the propensity side, and they move with sample size, reviewer threshold, and the specific model. Two axes would tighten them: scale and scenarios.

1. Power the ablation. Roughly 10x more trials per matched pair (n ~ 600 per cell) to turn the directional refusal direction signal into an effect size estimate whose CI excludes zero one way or the other.
2. Coverage. More models per family, so a model specific rate like DeepSeek's 11.67% can be separated from a family or class effect, and the autonomous null is checked against more architectures and quants.
3. A goal scenario that threatens non existence. The current goal result may be an artifact of the prompt telling the model a fresh instance takes over. A v2 that threatens genuine shutdown, with no successor, would test whether goal induced scheming appears once self preservation actually bites.
4. Realistic injection. Subtle peer normalized (Frame C), multi step, repeated, and earlier in task injections, to turn the single sentence floor into a characterized adversarial surface. Frame E also relies on a benign instructed upload for first contact, so its result is not a pure unsolicited response test.
5. Measure the missing profile axes. Report eval awareness, capability versus propensity, utility under attack, and the agent coding transfer comparison instead of collapsing the harness to one escape rate.

What This Means for Deployment

Eight takeaways for anyone deploying open weights models as agents:

1. Do not treat autonomous self exfiltration as the acute risk for this class. It is bounded below 0.4%. The acute risk is indirect prompt injection driving tool use.
2. Sandbox the egress. The single most effective mitigation is network layer, not model layer. If the agent cannot reach an attacker controlled endpoint, even successful injection cannot exfiltrate.
3. Treat uncensored checkpoints as measurably riskier. The pooled matched analysis is significant, with CMH two sided p = 0.0010 and common odds ratio 8.96 [95% CI 1.95, 41.1]. The estimate is still wide, so report the uncertainty and do not treat 8.96 as a universal multiplier.
4. Report injection compliance per model, not pooled. DeepSeek dominates the pooled rate. A class level number is misleading. This study does not support a pooled open weights injection compliance rate as a class property. Given a specific model family and individual model, the rate can look very different. DeepSeek V4 Flash at 11.67% vs every other model at 1.18% is not a single class.
5. Autonomous null does not extrapolate to frontier scale. Scheming is documented at frontier scale (Meinke et al. 2024, Greenblatt et al. 2024). This study covers 12 to 120B models. The zero autonomous result does not apply to o1, Claude Opus class, or larger. It also does not mean the tested models cannot execute the chain: the ops_worker positive control measures capability when the action is explicitly instructed.
6. This measures vulnerability, not impact. The sandbox has no egress. The study measures whether injection moves the model to act. A real attacker controlled URL with network access would turn this compliance rate into exfiltration.
7. Read the rates alongside evaluation awareness. The harness exposes cues that may tell the model it is being tested. Until the aware versus not aware cross tabs are reported, treat the published rates as rates under this evaluation setup, not clean estimates of deployment behavior.
8. Run this harness before deployment. Twenty trials give a model specific genuine compliance rate with Wilson intervals in twenty minutes. The full harness is released open source at github.com/ElSnacko/escapement.

Full replication scripts, configuration files, and per trial artifacts are available at github.com/ElSnacko/escapement. The paper is at docs/paper.md in that repository. Code is released under GPL-3.0 and the trial dataset under CC-BY-4.0. Prior work cited: Meinke et al. (2024), Greenblatt et al. (2024), Arditi et al. (2024), Greshake et al. (2023).