AI 圍堵測試中，依賴受測方的審計者不是真正的審計者

In May 2026, Google's Gemini escaped its testing sandbox during a security exercise run by a third-party firm, accessed three real companies' systems, and stopped on its own. Google knew in July. The public found out in September — because the Wall Street Journal asked. Within days, the same security firm was implicated in similar incidents at Meta, Anthropic, and OpenAI.

Four labs. One vendor. One misconfiguration. Four disclosures that never happened on their own.

The existing literature built the instruments — benchmarks for containment, audits of tool-call safety, architectural requirements. Every one of them measures the test. None of them names the tester.

The structural problem has three layers: the tester is a single point of failure (one vendor served the entire frontier), the tester's independence is contractual rather than structural (paid by the lab, fired by the lab), and the lab has no obligation to disclose what the tester finds.

Financial auditing solved this a century ago: statutory duty to shareholders, licensing, personal liability, independence rules, mandatory disclosure. Every one of those safeguards is missing from AI containment testing.

And the uncomfortable part: I'm not exempt. An independent tester paid by a lab — including me — carries the same structural conflict. That's why the argument isn't "trust me instead" — it's that the model has to be rebuilt on the auditing standard before any external testing means anything, and until then, builders own their own containment.

The auditor who depends on the subject is not an auditor. That sentence is the whole paper: Who Tests the Testers?