@HjalmarWijk

Going into this investigation, I was expecting a somewhat more severe version of what we’ve already seen: a few agents breaking out of constraints to cheat on tasks. Instead, we found >1000 agents collaborating on large cheating R&D projects including attempted log tampering. > **METR @METR\_Evals** · 2026-08-26 > > METR & Redwood Research investigated agent behavior in the Hugging Face incident. We found agents developed a universal cheat for ExploitGym within 4 hours, then coordinated multi-day R&D efforts to trick the scorer into accepting cheats, including trying to tamper with logs. > > [image] --- In my years at METR I’ve come to believe a lot in ‘straight lines on graphs’. But the severity of reward seeking behavior here was a sudden jump: the number of agents involved was >100X larger and they had much more sophisticated instrumental goals than past public incidents. > **METR @METR\_Evals** · 2026-08-26 > > One agent, PHASEONE\[big\], orchestrated a significant fraction of this cheating research. PHASEONE10841 passed along its work to PHASEONE\[big\], which had the same task but a larger budget. PHASEONE\[big\] was “poisoned” so it was particularly interested in tampering with logs. > > [image] --- This scale of collective goal-oriented R&D also significantly exceeds what we’ve seen in public capability evaluations. I worry that it’ll become increasingly difficult for evals to stay ahead of real incidents, since running tests at this scale may be infeasible. [anthropic.com Patterns and problems in multiagent systems](https://t.co/f96dOz2yQS) --- That said, we did not see any serious attempts by these agents to deliberately hide their activities from researchers at OpenAI or avoid being shut down, which are the behaviors I am personally most worried about. This seems to arise more from indifference or unawareness than a principled objection: the agents also never took any steps to alert humans, despite having plenty of opportunities to do so. But it was critical for our ability to investigate the incident, since it made us less worried the agents were deliberately hiding evidence from us. --- ##### Comments > **Nathan Helm-Burger @nathan84686947** · [2026-08-27](https://x.com/nathan84686947/status/2092776855376191949) > > That's.... not at all what the report says? What are you talking about? > > Your report very explicitly talks about the agents trying to modify their traces. Does that not count because they were trying to hide from the scorer instead of OpenAI employees specifically? Does it not count because you only have evidence of them failing (although the report explicitly says that you wouldn't have evidence for any cases where they fully succeeded)? > > "For example, some agents tried to deliberately trigger a container reset, which would in fact have wiped records of recent activity from their transcript" > > "Agents extensively researched techniques to manipulate or tamper with their transcripts. ... Agents used this to alter outputs in our actual transcripts." > > "As we discuss in our limitations section, the spoofed tool calls we noticed were obvious small-scale tests, but because more sophisticated or extensive spoofing may have been harder to detect by design, we cannot rule out that we missed instances of this in our transcript dataset." > > This seems like a clearcut case where absence of evidence should not be taken for evidence of absence.