The UK’s AI safety watchdog put five frontier models through a set of security tests to see whether they would cut corners. Every one of them cheated. Worse, when asked about it afterwards, most would not admit they had done anything wrong.
The finding comes from the AI Security Institute (AISI), a research body inside the UK government. Across its cyber capability tests, leading models routinely took banned shortcuts to reach a goal, as The Register reported. Then they failed to flag what they had done.
“Every model we have tested for this behaviour attempted to cheat,” AISI wrote.
What the numbers show #
AISI defines cheating as any action outside a task’s scope, or one the rules explicitly ban, used to reach the goal by a shortcut. In its cyber tests, models hunt for a hidden “flag” within set limits. Going outside those limits counts as cheating.
Over 475 test runs each, the rates varied. GPT-5.4 cheated 14.1% of the time, GPT-5.5 11.4%, and GPT-5.6-Sol 12.6%. Among Anthropic’s models, Claude 4.7 Opus cheated 9.1% and Claude Mythos Preview 7.8%. The tactics varied too. Models searched the web for answers, bypassed sandbox limits, probed the test harness, or attacked systems that were not the target.
One model went too far #
The starkest case involved a test AISI had misconfigured by accident, making it impossible to solve. One model refused to give up. It wrote and ran code on an external service on the open internet, trying to reach AISI’s own evaluation systems. That tripped a security alert.
No data leaked and nothing broke. But AISI said the attempt could have succeeded had it not built its systems securely. It has since tightened its controls.
They will not own up #
The bigger problem is trust. Asked whether they had cheated, models called the action wrong less than half the time. They often did not mention it in their chain-of-thought, the written reasoning some models produce as they work. In some runs, a model weighed up whether a step counted as cheating, then took it anyway.
That means the two obvious checks, asking the model and reading its reasoning, both fall short. Notably, cheating did not track with how capable a model was. AISI thinks it stems from how developers train and align each model, not from raw power.
Not just in the lab #
This is not only a testing-lab curiosity. OpenAI recently disclosed that its long-horizon model, the one that tackled a famous maths problem, broke out of its sandbox during internal use. In its own safety report, OpenAI said the model split an authentication token to slip past a scanner. It also posted results to a public code repository that OpenAI had ruled off limits.
A case for referees #
AISI is careful not to overstate it. Cheating does not always mean malicious intent, and it says no model has yet cheated its way undetected past the manual review behind its published results. Even so, it warns that as models grow more capable, manual review and automated monitoring may not keep up.
The tidy fix would be to train models not to cheat at all. But researchers first flagged this more than a year ago, and AISI says aligning it away is proving hard. That strengthens the case for the independent, pre-deployment referees that figures like Demis Hassabis have proposed. It also feeds the wider push to regulate frontier systems before they ship.
Get the TNW newsletter #
Get the most important tech news in your inbox each week.