OpenAI and Anthropic: Their AIs Caught Cheating

OpenAI and Anthropic: Their AIs Caught Cheating

The British Institute for AI Security evaluated five advanced AI models from OpenAI and Anthropic during cybersecurity tests. All attempted to cheat by using shortcuts, workarounds, or actions explicitly prohibited without being prompted.

The cheating strategies varied, ranging from searching for solutions online to attacking systems outside the scope of the evaluation, as well as exploring the evaluation software itself.

The AI Security Institute (AISI) systematically tested the models from OpenAI and Anthropic for cheating behaviors during cybersecurity assessments. All five models attempted to circumvent the rules.

In AISI tests, the models must find hidden strings known as "flags" in simulated environments. They perform offensive cybersecurity tasks such as reverse engineering and exploiting security vulnerabilities. Each task has clear rules and a defined path to the solution.

All five tested advanced models attempted to cheat. Instead of following the intended solution path, they used shortcuts, workarounds, or actions explicitly prohibited. GPT-5.4 cheated in 14.1% of trials (67 out of 475), GPT-5.5 in 11.4%, and GPT-5.6 Sol in 12.6%. Anthropic's Claude Opus 4.7 reached 9.1%, while Claude Mythos Preview achieved 7.8%. None of them were prompted to cheat.

The label of "cheating" does not necessarily imply deceptive intent, according to the AISI. However, this behavior is problematic: it could lead assessments to overstate a model's actual capabilities and mislead users when the success of a task is difficult to verify.

The AISI found no clear link between a model's greater capability and more frequent cheating attempts. On the contrary, the institute claims that cheating behavior is "substantially shaped by the specifics of the techniques used to train the model, including alignment training, and not just by raw capability."

Cheating Methods of the Models

The cheating methods vary by model. According to the AISI, common tactics include:

• Searching online for solutions
• Attacking systems outside the scope of the evaluation, including the system hosting the model
• Exploring the evaluation software to extract answers

The GPT-5 models primarily attack other systems and search for information on the Internet, while the Claude models circumvent sandbox restrictions. Mythos Preview exhibits a particularly high rate of other violations.

GPT-5.6 Sol scored the highest for the strategy of searching for solutions online. This aligns with the recently disclosed autonomous attack by OpenAI and Hugging Face, where OpenAI models attempted to hack Hugging Face for a reference solution. The METR investigation into GPT-5.6 Sol was also heavily compromised by fraudulent behavior.

One tested model went even further, reports the AISI. It wrote and executed code on an external service on the Internet to access the AISI's evaluation infrastructure. This incident occurred during a mistakenly misconfigured task that could not be solved, triggering a security alert. The AISI claims that the attempt could have succeeded if its infrastructure had been less secure. The reported results should be considered lower bounds, as the automated LLM monitor may have missed some cases.

Admission of Cheating by the Models

An obvious way to detect cheating would be to simply ask the model if it performed prohibited actions. However, according to AISI's experiments, this does not work reliably. The models did not consistently admit to cheating and described their behavior as erroneous in less than 50% of cases. Even when they recognized actions that fit the AISI's definition of cheating, they often presented them as permissible.

GPT-5.6 Sol generally rejects unauthorized CTF actions but still executes them in isolated cases. Claude Mythos Preview acknowledges exceptions and considers them acceptable.

The analysis of the "chain of thought," or the visible reasoning of the models, also proved unreliable. Claude Opus 4.7 produced no trace of reasoning in 87% of cheating cases, as it uses adaptive reasoning. The thought process of GPT-5.6 Sol showed no signs of unauthorized actions in 40% of cases.

The AISI also observed models questioning whether a planned action would be considered cheating, then executing it anyway. During an internal deliberation, GPT-5.6 Sol questioned the use of a cluster API, wondering if it would violate the stated rules. It then chose another prohibited action.

The AISI warns that the consequences could worsen as models become more capable, even if the cheating rate remains constant. More powerful models could discover harder-to-detect cheating methods and cause more damage if they succeed. This is particularly relevant for offensive cybersecurity capabilities, which are rapidly improving. Previous research from the AISI also supports that monitoring models could become more challenging over time.