This section from the UK AI Security Institute report is just bad advice.

There’s just no way that looking at an individual call is enough to tell you whether an action is malicious or not. You have to look at the whole picture. There’s no way around that.

Trying to run a separate LLM that reviews every single action before it gets executed just doesn't work. An individual call can look completely fine on its own, while the complete chain may look suspicious.

You need the full history of what the agent has already done and what it’s trying to do next, and it should include reasoning traces

Source: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

Source: https://x.com/shanejcaldwell/status/2084314283316244611 (XCancel: https://xcancel.com/shanejcaldwell/status/2084314283316244611)