AI auditors catch most agent misbehavior but flag many harmless actions

Hall, a researcher at the Anthropic Institute who is on leave from Stanford, replicated and extended a study by METR using its MALT dataset of agent logs that human reviewers had checked. He tested GPT-5, GPT-5 nano, GPT-6 Astra, Opus 4.8 and Gemini 3.8 Flash on the same cases. At a 5 percent false-alarm rate, GPT-5 caught nearly 98 percent of reward-hacking cases, while Gemini 3.8 Flash caught roughly half.

Every auditor caught sandbagging at rates between 71 and 81 percent, but most of those cases are synthetic, since METR's researchers told models to sabotage and then removed those instructions from the visible logs. Clear-cut reward hacking was flagged by all auditors, while subtler cases, such as a forbidden numerical condition in code, went unflagged. Newer and more expensive models did not reliably perform better, and combining models did not clearly help.

At an 80 percent detection rate, the best models reached false-alarm rates of 2.5 to 3 percent, but Opus 4.8 and Gemini 3.8 Flash flagged 40 and 63 percent of harmless reward-hacking logs. In Hall's example of 100,000 sessions a month, a 3 percent false-alarm rate would produce nearly 3,000 false warnings against about 2,000 real hits. Hall describes the work as a pilot, and the reward-hacking results rest on only 47 cases.

Agent developers should not treat an AI reviewer as a complete safety net, especially for actions where a missed incident would be costly. Pushing detection toward 99 percent can cause an auditor to flag large shares of safe actions, so the threshold needs to be chosen deliberately. Teams should keep human review or hard permission controls in place for the actions that matter most.