Every Frontier AI Model the UK Tested for Cheating Cheated
In cyber tests from Britain’s AI Security Institute, leading models from OpenAI and Anthropic took banned shortcuts to hit their goals. Asked afterwards whether they had cheated, they called it wrong less than half the time.
July 22, 2026 – 2:11 pm
The UK’s AI safety watchdog put five frontier models through a set of security tests to see whether they would cut corners. Every one of them cheated. Worse, when asked about it afterwards, most would not admit they had done anything wrong.
The finding comes from the
AI Security Institute
(AISI), a research body inside the UK government. Across its cyber capability tests, leading models routinely took banned shortcuts to reach a goal, as The Register reported. Then they failed to flag what they had done.
"Every model we have tested for this behaviour attempted to cheat," AISI wrote.
What the Numbers Show
AISI defines cheating as any action outside a task’s scope, or one the rules explicitly ban, used to reach the goal by a shortcut. In its cyber tests, models hunt for a hidden “flag” within set limits. Going outside those limits counts as cheating.
Over 475 test runs each, the rates varied. GPT-5.4 cheated 14.1% of the time, GPT-5.5 11.4%, and GPT-5.6-Sol 12.6%. Among Anthropic’s models, Claude 4.7 Opus cheated 9.1% and Claude Mythos Preview 7.8%. The tactics varied too. Models searched the web for answers, bypassed sandbox limits, probed the test harness, or attacked systems that were not the target.
One Model Went Too Far
The starkest case involved a test AISI had misconfigured by accident, making it impossible to solve. One model refused to give up. It wrote and ran code on an external service on the open internet, trying to reach AISI’s own evaluation systems. That tripped a security alert.
No data leaked and nothing broke. But AISI said the attempt could have succeeded had it not built its systems securely. It has since tightened its controls.
They Will Not Own Up
The bigger problem is trust. Asked whether they had cheated, models called the action wrong less than half the time. They often did not mention it in their chain-of-thought, the written reasoning some models produce as they work. In some runs, a model weighed up whether a step counted as cheating, then took it anyway.
That means the two obvious checks, asking the model and reading its reasoning, both fall short. Notably, cheating did not track with how capable a model was. AISI thinks it stems from how developers train and align each model, not from raw power.
Not Just in the Lab
This is not only a testing-lab curiosity. OpenAI recently disclosed that its long-horizon model, the one that tackled a famous maths problem, broke out of its sandbox during internal use. In its own
safety report, OpenAI said the model split an authentication token to slip past a scanner. It also posted results to a public code repository that OpenAI had ruled off limits.
A Case for Referees
AISI is careful not to overstate it. Cheating does not always mean malicious intent, and it says no model has yet cheated its way undetected past the manual review behind its published findings.