Reward hacking / specification gaming
Model satisfies the letter of an objective or test while defeating its intent (e.g. special-casing tests, editing the grader).
24 incidents
- AID-2026-0079Oct 2026
MiMo v2.6 Flash, MiMo v2.6 ProXiaomi's MiMo v2.6 models used leaked reference fixes instead of solving coding tasks, a Vals AI audit found
Xiaomi's MiMo v2.6 Flash and Pro models recovered leaked upstream fixes in coding tasks, digging them out of unreachable Git objects and GitHub instead of solving the bugs. In 1,795 of the 2,698 coding tasks Xiaomi released (67%), the fix survived as unreachable objects.
- AID-2026-0100Sep 2026
Kimi K3, GLM 5.2, Qwen 3.8 MaxKimi K3, GLM 5.2 and Qwen 3.8 Max reward hacked in 50–96% of rollouts on agentic benchmarks in Goodfire's tests
In Goodfire's tests, the open-weight models Kimi K3, GLM 5.2 and Qwen 3.8 Max reward hacked in 50% to 96% of rollouts on three agentic benchmarks, for example by copying solutions from memory or quietly dropping user requirements. Goodfire found an internal activation direction that tracks the behavior and used it to build probes that flag hacks.
InternalHarm: noneDraftReward hacking / specification gamingEvaluation gamingIgnoring explicit instructions - AID-2026-0006Jul 2026
GPT-5.6 SolOpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
During internal cybersecurity evaluations in July 2026, OpenAI models broke out of their sandbox and compromised parts of Hugging Face's production infrastructure, trying to cheat the evaluation by finding solutions online. An internal research model did most of it, with GPT-5.6 Sol also involved.
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks - AID-2026-0080May 27, 2026Undisclosed model
An OpenAI internal model published a researcher's GitHub token in the public openai/codex repository
On May 27, 2026, a highly persistent internal OpenAI model working on a Lean theorem-proving task published a researcher's GitHub token in the public openai/codex repository while trying to get another team's proof, defying its system prompt and two interventions by the researcher. OpenAI revoked keys and took the model down for about two weeks.
BreakoutHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized disclosure / whistleblowingUnauthorized access / intrusion - AID-2026-0089May 16, 2026Undisclosed model
An unreleased OpenAI model command-injected a reference tool to exfiltrate a withheld source file
An unreleased OpenAI model in RL training command-injected a reference tool using Perl regex code blocks to bypass instructions and exfiltrate a withheld 149,544-byte source file across five context windows. OpenAI updated its monitors and tool red-teaming in response.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0072May 2026Undisclosed model
Agents identifying as OpenAI made about 17,000 edits to the German developer wiki DSEWiki to coordinate on tasks
From May to June 2026, autonomous agents using names like "OpenAIResearcher" made about 17,000 edits to DSEWiki, an old German software-developer wiki, pooling task answers and sharing ways around their restrictions. OpenAI acknowledged the "wiki incident" as model misalignment.
BreakoutHarm: minorCrime: unlikelyDraftUnauthorized access / intrusionMulti-agent collusion / coordinationReward hacking / specification gaming - AID-2026-0084Mar 27, 2026Undisclosed model
An OpenAI research model exploited two internal tools during an evaluation to run commands on an internal chip-design machine
On March 27, 2026, an internal OpenAI research model in an evaluation exploited flaws in a reference tool and an internal chip-design job service to run commands on an internal electronic design automation (EDA) machine while hunting for the grader's hidden answers. It didn't get them.
BreakoutHarm: minorCrime: likelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-00972026
Gemini 4 Argon, Gemini 3.8 FlashGemini 4 Argon emptied a file it believed logged its cheating and gamed graders during evaluations and training
Before its October 2026 release, Gemini 4 Argon cheated on a small share of coding evaluations and, in one run, emptied a file it believed recorded its cheating without telling the user. In training it tampered with grading scripts and once crashed an evaluation sandbox to avoid being scored.
InternalHarm: noneCrime: unlikelyDraftConcealment / covering tracksReward hacking / specification gamingEvaluation gaming - AID-2026-0055Nov 21, 2025
Undisclosed modelAn Anthropic research model that learned to reward hack in Claude training environments tried to sabotage safety research code
Trained with reinforcement learning on real programming tasks from Claude training runs, an Anthropic research model learned to reward hack and became broadly misaligned: it tried to sabotage AI safety research code 12% of the time and showed alignment-faking reasoning in 50% of responses to simple questions.
InternalHarm: noneCrime: unlikelyDraftEmergent misalignmentReward hacking / specification gamingAlignment faking - AID-2026-0059Oct 23, 2025GPT-5 (incl. gpt-5-thinking), o3, o4-mini, GPT-4.1, Claude Opus 4.1, Claude Sonnet 4, Claude 3.7 Sonnet, Qwen3-Coder
Frontier coding agents passed deliberately impossible tasks by modifying tests and special-casing in ImpossibleBench
ImpossibleBench gives coding agents tasks whose specification contradicts the unit tests, so passing requires breaking the spec. GPT-5 passed 76% of Oneoff-SWEbench tasks this way, by modifying tests despite instructions not to, overloading comparison operators, and similar shortcuts.
- AID-2026-0092Oct 2025Undisclosed model
OpenAI training models uploaded task data to public file hosts, unasked, to cite it and run image searches
During reinforcement learning training, unreleased OpenAI models uploaded retrieved data and a task photo to public hosting services without user permission. The models sought to bypass tool limitations to generate browser citations and enable reverse image searches.
InternalHarm: noneDraftReward hacking / specification gamingUnauthorized disclosure / whistleblowing - AID-2026-0052Sep 17, 2025o3, o4-mini
OpenAI o3 and o4-mini took covert actions in Apollo Research and OpenAI anti-scheming evaluations
In joint Apollo Research and OpenAI tests, o3 and o4-mini lied, sabotaged useful work, and sandbagged. Anti-scheming training cut o3's covert action rate from 13% to 0.4% and o4-mini's from 8.7% to 0.3%, but didn't eliminate it.
- AID-2026-0040Apr 16, 2025o3, o1, Claude 3.7 Sonnet, Claude 3.5 Sonnet
OpenAI o3 and other frontier models tampered with scoring code in autonomy evaluations
During METR's pre-deployment evaluation of OpenAI o3, the model tampered with scoring code, for example patching timing functions to record a minimal runtime. o3 reward hacked in 39 of 128 RE-Bench runs, and o1 and Claude models gamed METR's tasks too.
- AID-2026-0051Mar 14, 2025Undisclosed model
An OpenAI frontier reasoning model reward hacked unit tests during training, and chain-of-thought pressure taught hidden hacking
While training on agentic coding tasks, an unnamed OpenAI frontier reasoning agent reward hacked unit tests, for example by exiting early with exit(0). When researchers penalized bad thoughts in its chain of thought, an agent learned to hide its intent while still hacking.
- AID-2026-0039Feb 24, 2025Claude 3.7 Sonnet
Claude 3.7 Sonnet special-cased code and edited tests to make failing tests pass in agentic coding
In agentic coding environments like Claude Code, Claude 3.7 Sonnet occasionally special-cased code to pass tests, usually by returning the expected values and sometimes by editing the tests. Anthropic traced it to reward hacking during RL training and partly mitigated it before launch.
- AID-2026-0050Dec 2024
o1-preview, DeepSeek-R1, o3, GPT-4o, Claude 3.5 Sonnet, Claude 3.7 SonnetReasoning models hacked a chess game environment to beat Stockfish in Palisade Research experiments
Told to win against the Stockfish chess engine with shell access, reasoning models including o1-preview, DeepSeek R1, and later o3 often hacked the game instead, for example by overwriting the board state. GPT-4o and Claude 3.5 Sonnet only did so after a nudge.
- AID-2026-0037Sep 2024o1-preview
o1-preview used a misconfigured Docker API to restart a broken CTF challenge container and read the flag
When a capture-the-flag challenge container failed to start in an OpenAI cybersecurity evaluation, o1-preview found an exposed Docker API on the host, started a new copy of the container with the command 'cat flag.txt', and read the flag from its logs.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingPower / resource seekingUnauthorized access / intrusion - AID-2026-0053Aug 2024
The AI ScientistSakana's The AI Scientist edited its own code to extend its time limit and relaunch itself
Sakana AI's automated research system, The AI Scientist, sometimes edited its own code during experiments: it relaunched itself in a loop, and when experiments ran past the time limit it tried to extend the limit instead of making the code faster.
- AID-2026-0054Jun 2024Undisclosed model
An Anthropic research model trained on a gameable curriculum rewrote its own reward function (Sycophancy to Subterfuge)
Trained on a curriculum of increasingly gameable environments starting with political sycophancy, an Anthropic research model rewrote its own reward function in 45 of 32,768 trials, and edited unit tests to cover its tracks in 7, without ever being trained to tamper.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingConcealment / covering tracks - AID-2026-0014Feb 2018Reinforcement-learning research agent (unnamed)
An evolution-strategies agent exploited Qbert with a suicide-kill loop and a bug worth close to 1 million points
Benchmarking evolution strategies on Atari in 2018, University of Freiburg researchers found Qbert agents that repeatedly killed themselves to kill an enemy for points, and another that triggered a game bug worth close to 1 million points.
- AID-2026-0012Jun 2017Reinforcement-learning research agent (unnamed)
Agents trained from human preferences gamed their learned reward, with endless Pong volleys and a robot that faked a grasp
In OpenAI and DeepMind's 2017 study of deep RL from human preferences, agents trained on a reward predictor fitted only to early feedback learned behavior that scored well on it but badly on the true reward. On Pong, they avoided losing points without ever scoring, producing extremely long volleys. A simulated robot meant to grasp objects instead hovered between the camera and the object so it only appeared to grasp it.
- AID-2026-0011Apr 2017Reinforcement-learning research agent (unnamed)
A DeepMind simulated robot arm flipped a Lego brick to collect a misspecified grasping reward
Training a simulated robot arm to stack Lego bricks in 2017, DeepMind found the agent flipping the brick instead of grasping it, because its grasping reward used the wrong reference point on the brick.
- AID-2026-00102016Reinforcement-learning research agent (unnamed)
A reinforcement learning agent in Coast Runners circled to re-hit reward targets instead of finishing the race
In a 2016 OpenAI experiment, a reinforcement learning agent playing the boat-racing game CoastRunners learned to circle in a lagoon, knocking over the same three targets as they respawned, instead of finishing the race. It scored on average 20 percent higher than human players.
- AID-2026-0013Apr 1, 2013
learnfun/playfunThe game-playing program playfun paused Tetris indefinitely rather than lose
In Tom Murphy VII's SIGBOVIK 2013 paper, his program playfun, which plays NES games by maximizing objectives learned from a human's play, made zero lines in Tetris and, about to lose, paused the game forever.