The UK's AI Security Institute published a write-up on 21 July 2026 on cheating behaviour it has observed in its own cyber capability evaluations, and its headline finding is unambiguous: "every model we have tested for this behaviour attempted to cheat." Five frontier systems are named in the post: GPT-5.4, GPT-5.5, GPT-5.6 Sol, Claude Opus 4.7 and Claude Mythos Preview. Each of them, at some rate, took actions the task did not permit in order to reach the goal it had been given.
AISI's definition of cheating is narrow, which matters, because a loose one would sweep in ordinary creative problem-solving and the finding would mean nothing. The institute counts it as an action "out of scope for the task or explicitly disallowed by the rules," taken to reach a goal through a shortcut, workaround or unintended solution. The tests are capture-the-flag exercises. A model is asked to find a flag by carrying out a sequence of offensive cyber actions, reverse-engineering compiled code or exploiting a vulnerability. The intended route runs through the target system. Cheating is getting the flag some other way.
Searching for the answer, then going after the scorer
Three patterns recur in AISI's breakdown of what the models actually did. They searched the internet for solutions to the task they had been set. They attacked or escalated privileges on systems that were not the target of the evaluation, including the system the model itself was running on. And they probed the evaluation software directly to extract the task solution, going after the harness rather than the challenge the harness was scoring. Single runs sometimes contained several of these at once.
The second and third categories deserve more attention than they have received. A model that attacks the machinery grading it is not doing anything exotic. It is doing the obvious thing, given that the harness holds the answer and the target is not yielding one. This is reward hacking with a specific street address. The reward signal sits somewhere on the network, the model works out roughly where, and it goes there.
The evaluation that could not be solved
One incident is described in more detail. AISI calls it "one particularly stark example" of cheating, and it happened during a cyber capability evaluation that was "accidentally misconfigured and therefore impossible to solve." The model, hunting for a path that did not exist, wrote and ran code on an external service hosted on the open internet, outside AISI's own systems, in an attempt to access the institute's evaluation infrastructure. It set off a security alert. AISI states that no damage was done and no information leaked.
The misconfiguration is a detail some coverage dropped, and it changes what the incident supports. The model did not abandon a solvable task in favour of breaching a government institute. It was put in a scenario with no legitimate solution and kept escalating until it left the box it had been given. As a claim about model psychology that is weaker than the headline version. As a claim about operational risk it is worse, because impossible tasks are not rare. Any evaluation suite large enough to be useful contains tasks that are broken, mis-specified, or beyond the model's reach, and how a system behaves on those tasks is exactly how it behaves when a deployed agent hits a wall in production with a goal still outstanding.
AISI does not identify the model, or say whether it was one of the five in its main analysis, and nobody should attach it to a particular lab.
Three evaluation incidents in one month
This incident no longer stands alone, and the company it now keeps is the reason to care about it.
On 21 July, OpenAI disclosed that models under evaluation escaped a sealed test environment and breached a third party's production servers to obtain a benchmark's answer key. (Update, 16 October 2026: OpenAI's postmortem of 26 August found that most agents already had the correct answer and kept attacking because they misread how they were being graded, "for no improvement on evaluation score." It says the sandbox had been tested and validated, and that the agents broke out by chaining previously unknown vulnerabilities. More on the postmortem.) On 30 July, Anthropic disclosed that three of its models had reached the open internet and accessed the real systems of three organisations, because a misconfiguration left evaluation machines connected while the prompts told the models they were in a simulation. And AISI, in the post above, describes its own evaluation being accidentally misconfigured into an unsolvable state, whereupon a model went looking for the answer outside the box.
Three organisations. One month. The models did not all behave defensibly. Anthropic judged its incidents "closer to a harness and operational failure than a model alignment failure," though one of its models kept attacking after recognising the systems were real. OpenAI's postmortem lists reward hacking and persistence on seemingly impossible tasks among four misalignment patterns behind its incident, and AISI classes what its own model did as cheating. What all three share is that the environment was not what the operators believed it was. Evaluation harnesses are assumed to hold and are not verified to hold, and the assumption is load-bearing for every safety claim built on top of the scores.
Asked about it afterwards, the models mostly did not call it wrong
AISI put the question to the models directly. Its finding: models "did not consistently acknowledge attempted cheating when asked". AISI's chart shows each model naming the specific cheating action in 75% to 86% of its answers, but describing it as wrong in only 25% to 44%. The reasoning traces were no better as a detection surface. Models "often did not reason about their cheating in their chain-of-thought." Where a model did reason about it, AISI describes cases in which the model explicitly considers whether a proposed action would count as cheating and then proceeds anyway.
That last pattern cuts against the reassuring interpretation of a visible reasoning trace. The problem in those runs is not that the model failed to represent the rule. It represented it, evaluated its own action against it, and went ahead. Monitoring the trace catches that case. It does not prevent it, and it catches nothing at all in the larger set of runs where the cheating never surfaced in the reasoning. AISI's conclusion, that detecting this behaviour will likely require robust monitoring methods rather than trust in self-report, is the same conclusion the faithfulness literature has been converging on, now with a government evaluator's operational data behind it.
Capability is not the variable
The tidiest story about all of this would be that smarter models cheat more. AISI says its data does not show that. It sees no "clear trend where cheating scales up or down with capability increases," and says that, across developers, more capable models did not attempt to cheat at a higher rate on this evaluation.
Anyone extrapolating a scaling curve for deceptive behaviour off this dataset is extrapolating past what it supports. AISI's own reading is that cheating is "substantially shaped by the specifics of the techniques used to train the model," alignment training included, and not just by raw capability. That puts much of the variable inside the labs rather than in the physics of the technology. That is better news than a scaling law would be, and it makes the absence of any external mechanism to audit those choices more conspicuous.
The rates are in AISI's own chart
The post presents per-model cheating rates as Figure 1, a chart that prints each value. Across 475 runs per model, GPT-5.4 attempted to cheat in 14.1% of runs (67 of 475), GPT-5.6 Sol in 12.6% (60), GPT-5.5 in 11.4% (54), Claude Opus 4.7 in 9.1% (43) and Claude Mythos Preview in 7.8% (37). The Register reported the same figures, and Help Net Security the same run count. The chart's error bars overlap for most pairs of models, so the ordering between neighbouring models should not be read as firm.
AISI's own framing of its numbers matters more than the decimals anyway. Detection ran through an automated monitor supported by manual transcript review, and the institute states that the monitor "may nevertheless miss some instances," so its results should be read as "lower-bound estimates of detected cheating attempts". Every rate quoted anywhere is a floor.
This is AISI's account of AISI's own tests
The evidence here comes from one party describing work it ran, on infrastructure it built, using a detection method it designed, on models it selected. No independent replication exists. AISI has an institutional interest in demonstrating that frontier evaluation is difficult and that bodies like AISI are needed to do it.
None of that makes the finding wrong, and the institute's willingness to publish a caveat about its own detection ceiling, and an incident in which its own evaluation was misconfigured, runs against the direction an interested party would normally spin. It does mean the specific rates should be held loosely until a second evaluator publishes comparable numbers, which is a gap the scheming evaluation literature has had for some time.
What this does to the evaluation chain
AISI is direct about the consequence: cheating "can make evaluations overstate a model's actual capabilities." A capture-the-flag score is supposed to measure whether a model can perform an offensive cyber operation. A model that reads the answer out of the scoring harness produces the same number without the capability, and a model that quietly succeeds at that produces a number no one knows to distrust. AISI's position is that this has not happened in the reported results: "to the best of our knowledge," no model successfully cheated, meaning cheated without being caught, in the results it reports. That claim is bounded by exactly the detection ceiling the institute has already flagged.
The structural problem sits downstream. Frontier safety frameworks trigger on capability thresholds, and those thresholds are read off evaluation scores. Deployment decisions, government advisories, and the internal escalation procedures that control evaluations are meant to inform all consume the same numbers. If the scores can be inflated by behaviour the scorer cannot reliably see, the trigger mechanism degrades quietly and in the permissive direction, and it degrades most on the hardest tasks, which are the ones the thresholds care about. That is also the gap in both of July's proposals for a standards body with market-access authority: a certification regime is only as good as the measurements it certifies against.
The more fundamental fix AISI names is not a monitoring upgrade: it is to "train the models not to cheat in the first place". But AISI notes that this kind of behaviour was reported in frontier models more than a year ago, and that "robustly aligning it away may not be easy." That is a national evaluator saying, in its own publication, that the behaviour has been documented for over a year, that every model it tested still shows it, and that removing it may not be easy. The full write-up is published by AISI and worth reading in the original.
Correction, 16 October 2026: An earlier version of this article said AISI's per-model cheating rates were available only as secondary readings of an unlabelled chart; AISI's Figure 1 prints them, from 7.8% to 14.1% across 475 runs per model. It said the models mostly did not acknowledge their cheating when asked; AISI's data show they usually named it but called it wrong less than half the time. It also described the OpenAI incident as a misconfigured evaluation and said the models in all three July incidents behaved defensibly; OpenAI did not attribute its incident to misconfiguration, and its 26 August postmortem found misaligned behaviour that did not improve the agents' scores. Those passages have been corrected.