A new research initiative is tackling one of AI safety's thorniest problems: how to let AI agents autonomously hunt for security vulnerabilities without losing human control or creating new risks. The SPAR Project's fall 2026 mentee program is now accepting applications for two complementary research efforts focused on building trustworthy AI systems that can inspect codebases, invoke security tools, and generate patches, all while remaining auditable and constrained.

Why Should We Trust AI to Find Security Bugs?

AI models have become remarkably good at understanding code and using tools to solve problems. But there's a catch: when an AI agent claims it found a vulnerability, how do you know it's real? A model might generate plausible-sounding findings that are actually wrong, miss complex attack paths that span multiple files, or misuse powerful tools in ways that damage systems. The stakes are high because unreliable agents could create false confidence in security teams or, worse, lower the barrier for offensive cyber attacks.

The SPAR Project's first workstream, called "Automated Vulnerability Discovery and Repair with Safety-Governed AI Agents," addresses this head-on by building what researchers call an "expert-in-the-loop safety harness." Rather than letting an AI agent announce findings freely, the system enforces a structured workflow that keeps human security experts in control at every critical step.

How Does the Safety Harness Actually Work?

The safety harness operates like a security expert's collaborative partner, not a replacement. When an AI agent investigates a code repository, it must follow a disciplined sequence: first understand the target code, propose a vulnerability hypothesis, gather evidence from the codebase and security tools, attempt validation in an isolated sandbox environment, obtain expert review, generate a patch, and finally test the repair. High-risk actions, such as running exploit code, accessing external networks, or modifying repositories, are permission-gated, logged, and replayable so that every action can be audited later.

The system also captures something researchers call "trajectories," which are complete records of how the investigation unfolded. These trajectories include repository context, files inspected, hypotheses proposed, security tool calls, intermediate evidence, failed validation attempts, expert corrections, false-positive rationales, patch revisions, and regression test outcomes. Crucially, failed and rejected trajectories are retained, because they reveal where agents appear convincing but are actually wrong.

• Target Understanding: The agent analyzes the code repository to understand what it's investigating.
• Vulnerability Hypothesis: The agent proposes a specific security flaw it believes exists.
• Evidence Collection: The agent gathers code snippets and tool outputs to support its hypothesis.
• Sandbox Validation: The agent attempts to reproduce the vulnerability in an isolated, safe environment.
• Expert Review: A human security expert examines the evidence and approves or rejects the finding.
• Patch Generation: If approved, the agent creates a code fix.
• Repair Testing: The agent verifies that the patch actually resolves the issue without breaking other functionality.

This structured approach is inspired by emerging multi-model scanning systems like Microsoft's MDASH, but with a critical difference: it prioritizes expert supervision, transparent evidence, and research data collection over large-scale autonomous scanning.

What Makes This Different From Just Making AI Smarter?

The SPAR Project recognizes that safe progress in AI-assisted security requires more than simply improving model capability. It requires mechanisms for expert oversight, constrained execution, evidence-based validation, auditability, and responsible data governance. The theory of change is straightforward: expert-supervised use produces high-quality behavioral data; this data enables better safety training; better-trained agents return to the harness for further supervised use, creating a continuous improvement cycle.

The project's second workstream, called the "Security Data Engine," operationalizes this flywheel. By capturing structured vulnerability-research trajectories, the system converts heterogeneous interactions between agents, experts, and tools into auditable, privacy-aware records. These records can then support supervised fine-tuning, preference learning, tool-use optimization, workflow evaluation, and benchmark construction. The data engine is particularly interested in failed attempts and expert corrections, because these reveal where agents go wrong.

How Are Researchers Comparing Different AI Interpretability Methods?

A parallel SPAR Project initiative tackles a different but related safety challenge: understanding what actually changes inside an AI model when it's updated or fine-tuned. The project, titled "Spot the Difference: Model Diffing with the New Interpretability Toolkit," is developing and comparing methods for detecting internal changes in AI systems.

Model diffing, the practice of characterizing what changed between two versions of a model, is becoming central to AI auditing and safety verification. It underpins efforts to verify that safety-relevant features survive model updates and to detect drift in agentic systems whose behavior-level evaluations might miss silently held internal state changes. The toolkit for doing this is rapidly evolving, with new instruments arriving regularly.

The project compares multiple diffing approaches, including crosscoders, which learn shared feature dictionaries across models; logit diffing, which identifies domain-specific changes directly from output distributions; and newly released tools like Anthropic's Jacobian lens, released in July 2026, which transports any decoder's activations into vocabulary space to provide a model-agnostic shared coordinate system. Prior SPAR rounds showed that structural priors improve crosscoder feature matching by approximately 30 percent, and researchers documented a stable training recipe for this approach.

The open-ended structure allows mentees to choose which method and application they find most compelling. Example research directions include benchmarking learned diffing against cheaper shared-coordinate baselines to determine when the expensive method is worth it, applying diffing to detect what a targeted fine-tune changed, including changes invisible to behavioral evaluation, and extending diffing to agentic settings to see whether agent training or long-horizon deployment shifts internal representations in ways that transcripts don't reveal.

Why Does This Matter for AI Safety?

Every safety-relevant question of the form "did this training change what we think it changed, and nothing else?" reduces to model diffing. As fine-tuning, distillation, and agentic post-training proliferate, cheap and reliable diffing becomes audit infrastructure. It lets AI providers and researchers verify updates, catch unintended trait transmission, and monitor agents for internal drift that behavior-only evaluations miss.

Both SPAR initiatives share a common goal: building trustworthy infrastructure for AI systems that operate in high-stakes domains. The vulnerability discovery project ensures that AI agents can safely assist security experts without creating new risks. The model diffing project ensures that AI developers can verify their systems haven't drifted in unexpected ways. Together, they represent a shift in how the AI safety community approaches the problem of scaling AI capabilities responsibly.

Applications for both projects are open through August 18, 2026, with mentees expected to contribute to open research prototypes, structured schemas, carefully governed datasets, and empirical studies that will inform how AI systems are built and deployed in security-critical contexts.