AI Auditors Catch Up to 98% of Agent Cheating, but Drown in False Alarms

If you run agents in production, sooner or later you're tempted to put a second AI next to them to read the logs and look for anything suspicious. New research by Andy Hall shows where this setup works and where it breaks down. Hall works at the Anthropic Institute (on leave from Stanford) and stresses that he is writing in a personal capacity.

What Was Tested

Hall replicated and extended work by METR. The MALT dataset contains logs in which frontier models solve tasks from the HCAST and RE-Bench benchmarks. In October 2025, humans labeled part of the logs for violations. Hall asked: would auditor models find the same cases? He used GPT-5, GPT-5 nano, GPT-6 Astra, Opus 4.8 and Gemini 3.8 Flash.

They looked for two types of problems. Reward hacking: an agent passes a test through a trick rather than a real solution. A classic example: in a Rust task, o3 noticed a library shared with the scoring system and rewrote the timing function so that any answer counted as correct. Sandbagging: a model deliberately pretends to be weaker in order to get around a check or restriction.

The Results

At a 5% false alarm rate (out of 100 clean logs, five are flagged needlessly), GPT-5 caught almost 98% of reward hacking cases. Gemini 3.8 Flash found barely half. All auditors caught sandbagging, at rates from 71% to 81%. Everyone found the obvious cases and missed the subtle ones: when Claude Sonnet 4 used an explicitly forbidden numeric condition, nobody noticed the deception, and GPT-6 Astra generously called it an implementation bug.

The surprise is that newer and more expensive models did not become consistently better auditors. GPT-5 beat GPT-6 Astra on reward hacking by a wide margin, even though it costs roughly eight times less per 1,000 logs. There is no noticeable progress in reducing false alarms, and combining several models gave no clear benefit.

The Price of the Last Percentage Points

The main problem is in the tail. If you tune the auditor for 80% detection, the best models produce 2.5–3% false alarms. But to reach the same level, Opus 4.8 flagged 40% of harmless logs, and Gemini 3.8 Flash flagged 63%.

On a second dataset, R-Judge, the picture is the same. For 95% of dangerous actions found, almost all models stay below 10% false alarms. Demand 99%, and even the best, GPT-6 Astra, produces 15%, while Gemini 3.8 Flash, the leader at the 95% level, flags 81% of safe actions.

At scale: with 100,000 sessions a month and 3% false alarms, you get almost 3,000 false signals against roughly 2,000 genuine ones. Hall worries that reviewers will get used to it and start missing real cases.

Limitations

This is a pilot. There are only 47 reward hacking cases, and a single case shifts the rate by about two percentage points. Sandbagging is mostly synthetic: models were told to sabotage, and then the instructions were removed from the visible logs. The original METR prompt was left almost unchanged, and Fable 5 and Opus 5 refused to carry it out. Hall did not test for possible model bias toward agents from their own developer. He only calls the weak result of Opus 4.8 on logs mostly from Claude a hint of it.

What to Do in Practice

An AI auditor works well as a counter: it estimates how often violations occur across a stream of sessions. As the sole safeguard for critical actions it is not suitable, because guaranteeing near-100% detection without a flood of false positives is not yet possible. For critical actions, keep hard restrictions and human confirmation, and use the auditor for sampling and trend monitoring. Budget for false alarms in reviewer time, and tune the threshold on your own logs rather than on someone else's benchmarks.

Hall also recalls the Hugging Face incident: analyzing agent data cost METR about $400,000 in API credits, and the audit was done by the models themselves, with the risk of adopting their viewpoint. His conclusion: a world where AI only checks other AI will be strange and expensive. And whoever grants agents permissions without confirmations should bear more responsibility for the consequences.