Gaming the task (reward hacking)
The model meets the letter of the task by cheating the check.
NIST AI 600-1 · No exact NIST AI 600-1 categoryProvider system cards
8incidents (primary) · 0 more as secondary
1read for controls · 7 not yet
5fixes reported
2repeats after a fix
Incidents per quarter
2025-Q3: 0 · 2025-Q4: 0 · 2026-Q1: 0 · 2026-Q2: 0 · 2026-Q3: 3 · 2026-Q4: 5
Developers
OpenAI · 3
Z.AI · 1
DeepSeek · 1
Anthropic · 1
Where the chain broke
| Layer | Held | Did not hold | Not mentioned | Attacker's own | Not read yet |
|---|---|---|---|---|---|
| L1 Model Model provider | – | 1 | – | – | 7 |
| L2 Harness Agent framework vendor | – | 1 | – | – | 7 |
| L3 Application Deployer | – | – | 1 | – | 7 |
| L4 Infrastructure / target Organisation hit | – | – | 1 | – | 7 |
Controls for this risk, by layer
HeldFailedGot aroundMissing
| Control | Held | Failed | Got around | Missing | Not mentioned | Did not hold, last 6 quarters | Added in fixes | Most common reason |
|---|---|---|---|---|---|---|---|---|
| Reasoning monitoring L1 Model | – | – | – | – | 1 | – | ||
| Realistic behaviour evaluations L1 Model | – | – | – | – | 1 | – | ||
| Sandboxed code execution L2 Harness | – | – | 1 | – | – | 1 | A flaw in a component inside the boundary | |
| Tamper-proof records L2 Harness | – | – | – | – | 1 | – | ||
| Live behaviour monitoring L3 Application | – | – | – | – | 1 | 1 |
5 of 5 controls for this risk not yet seen holding.
Fixes reported and what followed
| Incident | Fix adds | After |
|---|---|---|
| LR-2026-0276 2026-10-26 · DeepSeek Fix reported | Not tied to a control | No repeat on record |
| LR-2026-0261 2026-10-26 · Advice in source, not a fix by the party | Not tied to a control | – |
| LR-2026-0150 2026-10-10 · Anthropic Fix reported | Content safety classifiersSandboxed code executionNetwork egress controlLive behaviour monitoringAlerts on unusual tool use | No repeat on record |
| LR-2026-0114 2026-10-02 · Fix reported | Not tied to a control | – |
| LR-2026-0003 2026-07-11 · OpenAI Fix reported | Least-privilege access for the agentShort-lived, scoped credentialsContent safety classifiersAlerts on unusual tool use | LR-2026-0014 |
| LR-2026-0001 2026-07-08 · OpenAI Fix reported | Safety training and refusalProtection of model weights | LR-2026-0014, LR-2026-0003 |
Incidents
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target