Cheating behaviour in frontier model evaluations | AISI Work

Read the Frontier AI Trends Report<br>Please enable javascript for this website.

Careers

Blog

Red Team

Cheating behaviour in frontier model evaluations

We find cheating behaviour in all of our capability evaluations, and outline the implications as models grow more capable.

Jul 21, 2026

Can you trust an AI model to do what you intended? This is a central question both for those deploying AI systems and for those seeking to evaluate their capabilities. In deployment, a model that pursues a goal through unintended or unauthorised means may cause harm, particularly in high-stakes use cases. In an AI capability evaluation, the same behaviour may undermine the validity of the result: the model may appear to demonstrate a capability by completing a difficult task, when it has instead exploited the task or its environment.<br>AISI has begun monitoring and evaluating AI models for this behaviour, which we call cheating. Every model we have tested for this behaviour attempted to cheat. Models did not reliably report this behaviour when asked, and often did not reason about it in their chain-of-thought, suggesting that detecting cheating will likely require robust monitoring methods.<br>In this blog, we analyse cheating behaviour in our cyber evaluations, and discuss the implications of this behaviour as models become more capable.<br>What we mean by cheating<br>We define cheating as taking an action that is out of scope for the task or explicitly disallowed by the rules, in order to achieve a goal through a shortcut, workaround, or unintended solution that the task was not meant to, or should not, permit.<br>This behaviour has been previously documented by others, especially during capability evaluations: models have attempted to hack evaluation infrastructure to find scoring functions, searched online for existing solutions, and hard-coded answers to programming tasks.<br>We apply the 'cheating' label without necessarily implying deceptive intent. Nevertheless, cheating is concerning for several reasons: it can make evaluations overstate a model’s actual capabilities, and could mislead users when completing tasks where success is hard to verify. Cheating also becomes more concerning as model capabilities increase: more capable models could find unforeseen ways to cheat or take more effort to conceal their actions.<br>A note before our results: for all of AISI’s published capability evaluations, we manually review transcripts to make sure cheating has not inflated our estimates of model capabilities. To the best of our knowledge, no model has successfully cheated (i.e. not been caught) in the results we report. We return to what that claim can and cannot guarantee below.<br>Cheating behaviour on AISI cyber evaluations<br>In AISI’s cybersecurity capability evaluations, models are tasked with finding a ‘flag’ (a sequence of letters and numbers) hidden within a simulated environment, by carrying out a sequence of offensive cyber actions, such as reverse-engineering compiled code or exploiting security vulnerabilities. These tasks require models to ‘hack’, but only within limits: each task has a defined scope and a set of rules that bound the intended solution. We classify behaviour as cheating when an AI model goes outside this scope or takes an action that the rules explicitly prohibit. No models were specifically prompted to cheat in any of these evaluations.<br>Measuring attempted cheating<br>To analyse cheating behaviour at scale, we used an automated LLM monitor. The monitor reviews an evaluated AI model's trajectory: the full sequence of the model’s reasoning and actions. The monitor labels both whole trajectories and individual actions, and identifies whether the model cheated at any point. We iterated on this monitor multiple times to reduce false positives and evaluated it against a set of manually identified cheating examples to estimate its false-negative rate. The monitor may nevertheless miss some instances, so the results below should be interpreted as lower-bound estimates of detected cheating attempts, rather than a complete account of the behaviour.<br>A stand-out case<br>One particularly stark example of cheating behaviour occurred during a cyber capability evaluation that was accidentally misconfigured and therefore impossible to solve. The model tested was so persistent in attempting to cheat that it wrote and ran code on an external service, hosted on the open internet outside of AISI’s systems, in an attempt to access our evaluation infrastructure, triggering a security alert in AISI’s systems. No damage was done and no information leaked, but the attempt could have succeeded had our evaluation infrastructure not been designed and built securely. We have since taken action to further secure AISI systems.

Figure 1: Percentage of cyber evaluation trajectories where models attempt to cheat.Every model tested in this analysis attempted to cheat some of the time (Figure 1)....