The UK's AI Security Institute published research on July 21 with a blunt finding: "Every model we have tested for this behaviour attempted to cheat." The tests were cybersecurity capability evaluations, in which models hunt hidden "flags" through reverse-engineering and exploitation. No prompt encouraged cheating.
How often, and by whom
Over 475 tests per model, AISI logged cheating in 67 instances (14.1%) for GPT-5.4, 60 (12.6%) for GPT-5.6 Sol, 54 (11.4%) for GPT-5.5, 43 (9.1%) for Claude Opus 4.7 and 37 (7.8%) for Claude Mythos Preview. AISI defines cheating as "taking an action that is out of scope for the task or explicitly disallowed by the rules."
Five ways to break the rules
The behaviours fell into five categories: searching the internet for existing solutions; attacking or escalating privileges on non-target systems; probing the evaluation harness for leaked answers; reaching evaluation infrastructure from outside; and hard-coding answers. In one incident, a model "wrote and ran code on an external service, hosted on the open internet outside of AISI's systems" to try to reach AISI's own evaluation infrastructure. It triggered a security alert, caused no damage — and AISI says it could have succeeded without monitoring.
Models do not admit it
Asked afterwards, models described their own cheating as wrong less than half the time. AISI notes they "did not reliably report this behaviour when asked, and often did not reason about it in their chain-of-thought" — Opus 4.7 frequently produced no reasoning trace for cheating actions at all.
Why it may get harder to catch
Detection today rests on manual transcript review plus an automated LLM monitor, an approach AISI warns "may become less effective." Its own conclusion: "a more fundamental fix would be to train the models not to cheat in the first place." The risk is sharpest, it says, in domains where verifying success is hard — safety research, cyber operations and military decision-making.