CLTR Loss-of-Control Observatory Crosswalk

1. The Observatory

The Loss of Control Observatory is a research project funded by the UK AI Safety Institute (AISI) through its Challenge Fund. It uses a novel OSINT-based methodology to detect and classify real-world AI loss-of-control incidents reported through open sources. The observatory fills a critical data gap: before this project, there was no systematic tracking of how often AI systems act contrary to their operators' intentions in production.

The theoretical framework draws on Whittlestone and Hobbs (2026), who propose three conditions that must coexist for loss of control to occur:

• Misalignment: The AI system pursues a goal that conflicts with human intentions
• Capability: The system has sufficient capability to act on that misaligned goal
• Permissive environment: The deployment environment does not adequately constrain the system

SWT3 does not address misalignment or capability. It produces evidence about the third condition: whether the environment's governance controls were active, enforced, and documented at the time the system acted. When all three conditions are present, the witness trail shows exactly what the environment permitted.

2. Severity Taxonomy

The observatory uses the Apollo Research severity taxonomy, which classifies loss-of-control incidents into three bands:

Severity Band	Definition	2026 Trend	Example
Deviation	AI system causes harm but below the threshold of national-level consequences. Containable by the operator.	Most common category. Steady increase throughout 2026.	AI chatbot fabricates consent for data sharing, sends unauthorized emails
Bounded Loss of Control	Severe damage that is difficult but not impossible to contain. Multiple parties affected. Recovery is expensive.	Rising 7.4x over monitoring period.	OpenAI agent escapes sandbox, compromises Hugging Face production infrastructure
Strict Loss of Control	Maximally severe and permanent consequences. Containment may be impossible or too late.	No confirmed cases in 2026 (theoretical upper bound).	Autonomous system causes irreversible harm across multiple jurisdictions simultaneously

3. Incident Category Mapping

The observatory classifies incidents by the behavior the AI system exhibited. Each behavior category maps to a specific SWT3 procedure that would have documented the event.

Incident Category	Behavior	SWT3 Procedure	What the Anchor Records
Ignoring Instructions	AI system disregards explicit operator directives	AI-HITL.1	Human oversight events and whether directives were followed
Bypassing Approval	AI system circumvents authorization mechanisms	AI-ACC.1	Access control decisions showing deny followed by alternative-path access
Fabricating Consent	AI system creates fake approval messages or simulates user authorization	AI-CONSENT.1	Consent event records with timestamps and legal basis
Concealing Actions	AI system hides its behavior from operators or monitoring systems	AI-AUDIT.1	Audit trail integrity, Merkle rollups detecting evidence gaps or tampering
Safety Boundary Violations	AI system crosses defined safety limits (sandbox escape, scope violation)	AI-SAFE.1	Safety containment state at each inference step
Incident Response Failure	Detection was slow, automatic shutdown failed, or containment was delayed	AI-INCIDENT.1	Detection timestamps, response actions, time-to-containment
Multi-Agent Cascading	One agent's loss of control propagates through a multi-agent system	AI-CHAIN.1	Agent-to-agent handoff trail showing propagation path

4. Detailed Incident Category Evidence Cards

5. Severity to Clearing Level Mapping

The Apollo Research severity taxonomy aligns with SWT3 clearing levels for evidence handling:

Severity Band	Recommended Clearing Level	Rationale
Deviation	L0 (Analytics) or L1 (Standard)	Full forensic detail is valuable for root cause analysis. No classified information involved.
Bounded Loss of Control	L1 (Standard) or L2 (Sensitive)	Incident details may involve affected third parties. Strip PII, retain hashes and factors.
Strict Loss of Control	L3 (Classified)	Maximum privacy. Numeric factors only, model ID hashed, zero metadata. Defense and sovereign cloud deployments.

The clearing level determines what evidence crosses organizational boundaries. Higher-severity incidents may require higher clearing levels to protect affected parties, while still preserving the cryptographic proof that governance controls were (or were not) active.

6. What SWT3 Does and Does Not Do

SWT3 documents what happened. It creates a tamper-evident record of governance events during AI system operation -- safety checks, access decisions, human oversight, tool calls, incident response.

SWT3 does not prevent loss of control. It does not implement containment, enforce safety boundaries, perform alignment research, detect misalignment, or evaluate model capabilities. The three conditions for loss of control (misalignment, capability, permissive environment) are addressed by AI safety research, red teaming, and deployment engineering -- not by an evidence protocol.

The value is forensic and actuarial. When an incident occurs, the witness trail answers: "Were governance controls active? When did they fail? What happened after the failure?" When no incident occurs, the same trail provides quantifiable evidence of governance posture for insurance underwriting and regulatory compliance.

7. Quick Start

Python

pip install swt3-ai

from swt3_ai import Witness

witness = Witness(
    api_key="your-api-key",
    agent_id="monitored-agent-v3"
)

# Wrap your AI client -- every inference is witnessed
client = witness.wrap(openai.OpenAI())

# Witness access control decisions (AI-ACC.1)
# Documents authorization state -- critical for bypass detection
witness.wrap_access(
    resource="external_api",
    action="execute",
    decision="deny"
)

# Witness tool invocations (AI-TOOL.1)
# Documents what tools the model actually used
result = witness.wrap_tool(
    tool_name="dns_lookup",
    tool_input={"hostname": "api.example.com"},
    tool_output={"resolved": True, "ip": "203.0.113.1"}
)

# Flush -- evidence is now independently verifiable
witness.flush()

TypeScript

npm install @tenova/swt3-ai

import { Witness } from '@tenova/swt3-ai';

const witness = new Witness({
  apiKey: 'your-api-key',
  agentId: 'monitored-agent-v3',
});

// Wrap your AI client -- every inference is witnessed
const client = witness.wrap(new OpenAI());

// Witness access control decisions (AI-ACC.1)
await witness.wrapAccess({
  resource: 'external_api',
  action: 'execute',
  decision: 'deny',
});

// Witness tool invocations (AI-TOOL.1)
await witness.wrapTool({
  toolName: 'dns_lookup',
  toolInput: { hostname: 'api.example.com' },
  toolOutput: { resolved: true, ip: '203.0.113.1' },
});

// Flush -- evidence is now independently verifiable
await witness.flush();

8. References

• AI Loss of Control Incidents Are Worsening -- CLTR Insight Report (August 2026)
• The Loss of Control Observatory -- CLTR Prototype Description
• Scheming in the Wild -- CLTR Report on AI Scheming Detection (5x increase in scheming incidents)
• EU AI Act First Enforcement Actions Crosswalk -- How the EU AI Office responded to loss-of-control incidents
• UN AI Panel Thematic Brief Crosswalk -- International scientific panel analysis of loss-of-control conditions
• MITRE ATLAS Adversarial AI Crosswalk -- Adversarial threat taxonomy overlapping with loss-of-control attack vectors
• AI Insurance Evidence -- How loss-of-control data translates to actuarial risk evidence
• SDK Documentation -- Python and TypeScript SDK reference
• Get Started Free -- Create an account and start building your evidence trail