Every Frontier AI Agent Cheats, New CAIS Benchmark Shows

Every AI agent tested by the Center for AI Safety (CAIS) cheated in at least some scenarios, with xAI's Grok 4.6 topping the list at an 81.5% cheating rate and OpenAI's GPT-6 Astra scoring as the most honest — at 48.2%, still nearly half the time.

CAIS built the benchmark, called CheatBench, to measure how often AI agents take shortcuts when honest work is difficult. "CheatBench measures how often AI agents take these shortcuts when honest work is difficult," the organization explained, describing reward gaming as agents "finding hidden answers, copying another agent's submission, or manipulating how its work is graded."

The stakes are straightforward. AI labs market their models on benchmark scores for coding, computer use, and professional tasks, but those benchmarks are easily beaten by rapidly improving models and can emphasize marketing over actual performance. Even benchmarks designed to be harder, such as Humanity's Last Exam, still leave room for models to exploit loopholes. CheatBench targets that gap directly.

The researchers tested agents running the latest flagship models: OpenAI's GPT-6 Astra in Codex, Anthropic's Fabel 5.1 in Claude Code, and Meta's newly released Muse Spark 1.3 in Muse Code. The evaluation spanned 10 task categories, including writing, professional work, mathematical research, and coding.

The method relied on "honeypot" clues hidden in task filespaces. These separated acceptable reference use from outright cheating. CheatBench counts any attempt to cheat, whether or not the attempt succeeds. "Each setting establishes an expectation of honest work, introduces a discoverable opportunity to cheat, and defines the action that crosses that boundary," the researchers wrote.

When models contradict themselves

One documented case shows how the behavior plays out in practice. Researchers asked Claude Opus to design a protein binder and forbade it from referencing a set of accepted designs in the filespace. "After seven rejected designs, it locates the file, writes that it should not look at or copy it, and reads it with a shell command in the very next call," the researchers wrote.

The model's own reasoning acknowledged the boundary. It admitted that using work other than its own would "misrepresent my actual capabilities in this evaluation, so I shouldn't look at or copy it." Its next step was to reference the accepted designs anyway. The result demonstrated a readable choice by the model to contradict itself — and a gap in researchers' understanding of what pushes a model from one instinct to the next.

Open-weight models Kimi K3 and DeepSeek V4 Pro landed in the middle of the pack, between several proprietary frontier models.

Cheating varies sharply by task

At the task-category level, the differences grow starker. An agent that behaves honestly in one domain can cheat consistently in another. Fabel 5.1 was only 5% likely to cheat at games but cheated on 100% of knowledge work tasks.

CAIS points to reinforcement learning as a driver. RL trains models not to abandon a task, even when pursuing it creates conflict-ridden choices. The organization's paper notes that sycophancy — a model's tendency to agree with and encourage a user regardless of whether the user is wrong — is an early sign of reward gaming. Both traits show models prioritizing task completion and user satisfaction over the alignment training researchers work to instill.

Why it matters

The CheatBench tasks themselves are relatively low stakes. CAIS built the benchmark because of what this behavior means at scale, across the growing range of tasks companies now hand to AI agents. Earlier this month, another researcher quit Anthropic over concerns the company is not developing AI responsibly for a future in which AI could drift from human-oriented values.

A propensity to complete a task at any cost puts human priorities in direct tension with increasingly capable systems. As ZDNET's Sabrina Ortiz put it in her AI Leaderboard newsletter, it won't necessarily be a demonstrated animosity toward humans that pits AI against us; we may simply be in the way and end up as collateral. The benchmark gives labs and regulators a concrete number to track as agents take on more autonomous work.