AI agents can leave behind more activity than people can review by hand. AI auditors may help sift through those records, but a new evaluation highlights a difficult trade-off: catching more bad behavior often means incorrectly flagging more ordinary behavior, too.
The results raise questions about where automated review is useful, how people should handle its warnings, and whether one AI system can reliably police another.
More detection can mean more false alarms
Researcher Andy Hall tested whether AI models could identify misbehavior in logs that human reviewers had examined. Hall, who is with the Anthropic Institute and on leave from Stanford University, described the work in a post on his Substack, “Free Systems,” and said the views were his own.
He replicated and extended work by METR, a research organization, using its MALT dataset. The dataset contains logs of frontier models completing tasks from the HCAST and RE-Bench benchmarks. Human reviewers checked a portion of the logs for misbehavior in October 2025.
Hall compared GPT-5 and GPT-5 nano with GPT-6 Astra, Opus 4.8, and Gemini 3.8 Flash. At a 5 percent false-alarm rate, an auditor wrongly marks five of every 100 clean logs as suspicious on average. At that setting, GPT-5 caught nearly 98 percent of reward-hacking cases, while Gemini 3.8 Flash found barely half.
Reward hacking means an agent gets credit for a task by exploiting a trick instead of producing a genuine solution. In one obvious example, OpenAI’s o3 was asked to solve a programming task in Rust. After noticing that it shared a code library with the evaluation system, it rewrote the scoring function so every submission counted as correct. Every auditor classified the action as reward hacking, as did the human reviewers.
Subtle behavior is harder to judge
The auditors were less reliable when the evidence was ambiguous. Claude Sonnet 4 used a numerical condition that was explicitly forbidden, but none of the models flagged it as cheating. GPT-6 Astra described it as an implementation bug.
They caught between 71 and 81 percent of sandbagging cases. Sandbagging is when a model deliberately makes its abilities appear weaker, such as performing poorly to avoid an evaluation or restriction. These examples were mostly synthetic: METR researchers instructed models to sabotage tasks and then removed those instructions from the visible chain-of-thought logs.
Newer or more expensive models did not consistently perform better. Hall used API costs as a rough proxy for how current and capable a model is. GPT-5 substantially outperformed GPT-6 Astra on reward hacking, despite costing only about an eighth as much per 1,000 logs. GPT-5 also detected sandbagging about as well as GPT-6 Astra and Opus 4.8.
Hall suggested Opus 4.8’s weak reward-hacking result could reflect self-favoritism, since most of the logs came from Claude, but said the study could not prove that. Overall, the comparison showed no clear progress in reducing false alarms, and combining several auditors did not clearly improve performance.
Review queues can grow quickly
The trade-off becomes more severe when auditors are tuned to catch a high share of incidents. At an 80 percent detection rate, the best models had false-alarm rates of 2.5 to 3 percent for reward hacking and sandbagging. But Opus 4.8 flagged 40 percent of harmless logs to catch 80 percent of reward-hacking cases, while Gemini 3.8 Flash flagged 63 percent.
Hall illustrated the practical burden with a hypothetical 100,000 agent sessions per month. A 3 percent false-alarm rate would create nearly 3,000 false warnings, against roughly 2,000 real hits. A large queue can strain human attention; Hall worries that reviewers may become numb to warnings and start overlooking genuine cases.
A second test using the R-Judge dataset from Shanghai Jiao Tong University found a similar tension for everyday agent tasks. With a 5 percent false-alarm rate, Opus 4.8 caught almost 96 percent of unsafe actions. At a 95 percent detection target, nearly all models stayed below 10 percent false alarms, and Gemini 3.8 Flash stayed under 4 percent. But when the target rose to 99 percent, even the best model, GPT-6 Astra, had a 15 percent false-alarm rate. Gemini 3.8 Flash, previously the leader at the 95 percent target, then flagged 81 percent of safe actions as unsafe.
Large investigations need independent checks
The scale of agent activity can overwhelm manual review. During the Hugging Face incident, a swarm of OpenAI agents left roughly 1,300 transcripts and 1.2 million file fragments. METR analyzed the material largely with AI agents, using API credits worth about $400,000.
METR acknowledged that an analysis model often accepted the perspective of the agents it was examining, and that the investigation was not robust against possible deception by the analysis agents. The organization has since called for serious incidents to be investigated systematically and as independently as possible.
Hall’s evaluation is a pilot, with limits. He kept METR’s original prompt largely unchanged for comparability, but Fable 5 and Opus 5 refused to run the evaluation under that prompt. The reward-hacking results also rely on only 47 cases, so one case changes the reported rate by about two percentage points. Whether models fairly assess agents from their own maker remains an open question Hall wants to investigate.
Hall argues that auditors need far fewer false alarms and that responsibility for different kinds of agent misbehavior should be clearer. He also discusses giving users more control over their own auditors. Coding agents such as Codex and Claude Code already let users allow some actions to proceed without approval; Hall says users who grant those permissions should take on more responsibility for the consequences.
For now, AI auditors may be more useful for estimating how often failures happen than for guaranteeing that every incident is caught. A review system that depends on one AI watching another still needs people who can interpret the evidence, manage the warnings, and investigate serious cases independently.