AI models are now pretty good at spotting when other AI agents cheat. The catch is that they raise so many false alarms that human reviewers could end up ignoring them. That’s the main result of a new pilot study by Andy Hall, The Decoder reports. Hall is a researcher at the Anthropic Institute, on leave from Stanford University, and he published the work on his Substack Free Systems. He says the post reflects only his personal views.
AI agents now run long, unsupervised tasks, so this matters a lot. If you can’t check what your agents did, you can’t trust them.
What Hall Tested
Hall replicated and extended a study by the research group METR. He used METR’s MALT dataset, which holds logs of frontier models working through tasks from the HCAST and RE-Bench benchmarks. Human reviewers had already checked some of those logs for misbehavior in October 2025.
Hall asked whether AI auditors could find the same cases the humans did. He tested five models:
- GPT-5 and GPT-5 nano, which METR had already examined
- GPT-6 Astra
- Opus 4.8
- Gemini 3.8 Flash
He looked for two kinds of misbehavior. Reward hacking means an agent passes a task with tricks instead of actually solving it. Sandbagging means a model deliberately underperforms, for example to dodge an evaluation or a restriction.
The Numbers
Hall compared the models at a fixed false-alarm rate of 5 percent. In other words, five out of every 100 clean logs get wrongly flagged as suspicious.
- Reward hacking: GPT-5 caught nearly 98 percent of cases. Gemini 3.8 Flash caught barely half.
- Sandbagging: all auditors landed between 71 and 81 percent.
The flip side is what stands out. When Hall tuned the auditors to catch 80 percent of misbehavior, the best models produced false alarms on 2.5 to 3 percent of clean logs. Others did much worse on reward hacking:
- Opus 4.8 flagged 40 percent of harmless logs
- Gemini 3.8 Flash flagged 63 percent
A second test used the R-Judge dataset from Shanghai Jiao Tong University, which covers everyday agent tasks. At a 5 percent false-alarm rate, Opus 4.8 caught almost 96 percent of unsafe actions. Pushing toward perfect detection gets expensive fast, though:
- At 95 percent detection: nearly every model stayed under 10 percent false alarms, and Gemini 3.8 Flash stayed under 4 percent.
- At 99 percent detection: even the best model, GPT-6 Astra, hit 15 percent false alarms. Gemini 3.8 Flash jumped to 81 percent.
Paying More Doesn’t Buy Better Audits
Newer and pricier models weren’t reliably better auditors. GPT-5 beat GPT-6 Astra on reward hacking by a wide margin while costing about an eighth as much per 1,000 logs. It also matched GPT-6 Astra and Opus 4.8 on sandbagging. Running several models together didn’t clearly help either, and Hall found no clear progress in reducing false alarms.
The obvious cheating got caught every time. In one case, OpenAI’s o3 rewrote a scoring function so every Rust submission counted as correct, and every auditor flagged it. The subtle cases slipped through. Claude Sonnet 4 used a numerical condition that was explicitly forbidden, and no auditor called it cheating. GPT-6 Astra generously described it as an implementation bug.
Why This Matters for Teams Running Agents
Hall’s worked example makes the problem concrete. Say you run 100,000 agent sessions a month. A 3 percent false-alarm rate gives you almost 3,000 false warnings next to roughly 2,000 real hits. He worries that reviewers buried under that pile will eventually stop paying attention and wave real problems through.
If you’re putting AI monitoring on top of your agents, here’s what I’d take from this:
- Benchmark your auditor on your own logs. Rankings change from task to task.
- Don’t assume the newest model wins. Older, cheaper models may do the job better.
- Budget human time for triage. Even good auditors produce thousands of flags at scale.
- Treat subtle rule-breaking as a blind spot. The auditors here mostly caught only blatant cheating.
The Hugging Face incident shows how big this problem can get. A swarm of OpenAI agents left behind about 1,300 transcripts and 1.2 million file fragments. METR spent roughly $400,000 in API credits analyzing them, mostly with AI agents, including GPT-5.6 Sol, one of the models involved in the incident. METR admitted the model often took on the point of view of the agents it was examining.
Limitations
Hall is upfront that this is a pilot:
- The reward-hacking results rest on only 47 cases, so a single case moves the rate by about two percentage points.
- Most sandbagging cases are synthetic. METR told models to sabotage and then removed those instructions from the visible logs.
- He kept METR’s original prompt for comparability, and Fable 5 and Opus 5 refused to run under it.
- Opus 4.8’s weak reward-hacking score could point to self-favoritism, since most logs come from Claude models, but Hall says he can’t prove that.
Hall wants auditor models with far fewer false alarms. He also wants clear answers on who is responsible for which kinds of agent misbehavior. As agent fleets grow, the bottleneck is shifting from catching bad behavior to helping humans keep up with the flags. The full breakdown is available at The Decoder.