Oversight
Most of what happens in a system is routine. A few events matter: an agent that games its reward or drifts from its goal, an intruder hiding in ordinary activity. Nobody - and no LLM - can read every run or every log line.
A world model learns what normal looks like, then ranks everything by its strangeness so that triage can assess what's most unusual. Agent oversight and cybersecurity both work this way, but their data, questions, and evidence differ, so each has its own section here.
Agent oversight
AI agents now run for hours. They write code, browse, call tools and work with other agents. Reviewers look for reward hacking, prohibited boundary actions, sustained loops and substantial goal derailment.
The model is not a language model. It scores recorded agent trajectories from their sequence of actions and consequences, a calibrated cutoff selects runs for closer review, and a reviewer reads the original actions and outcomes in context. A high score means unusual, not harmful.
In recorded AI Village activity from September 2026, it surfaced a Gemini 2.5 Pro agent that spent 11,322 turns writing and verifying text one character at a time. Within that run the actions were predictable. Compared with the wider agent activity the pattern was unusual, and that brought the run forward.
Research note: Agent Oversight
Results: Screening results informed by 220 human-reviewed trajectories across three datasets. Human judgments correct the automated reference labels; the reported error rates are sample-based estimates.
Watch it work: The world model at work
In the Factory: Agent oversight ยท members only
Talk to us about overseeing your agents
Cyber
Security is a problem of finding a few events that matter inside millions that do not. A world model learns the normal dynamics of a system rather than matching each event against a static rule: what is genuinely unusual, which separate events belong to the same incident, and where an analyst or agent should look first.
Results: In one current evaluation, a model ranked attack activity in a chronological tail of a host log at 0.726 AUROC against chance 0.50, across three seeds. That ranking can provide a short list for an analyst or language model to investigate. This evaluation does not establish an advantage over a frontier model. The detailed report is not public yet.
Watch it work: In a saved investigation, a language model gets a read-only command-line tool over a world model trained on one tenant's ordinary activity, and is asked to find intrusions. It has no alerts, rules or threat intelligence. Every command and result on the page was recorded; the page makes no model calls.
In the Factory: Cyber defense