AI models auditing other AI agents catch most cheating but generate heavy noise. At a 5 percent false-alarm rate, GPT-5 detected nearly 98 percent of reward hacking cases in the MALT logs, while Gemini 3.8 Flash found barely half. Researcher Andy Hall, on leave from Stanford and writing for the Anthropic Institute in a personal capacity, concludes such tools fit estimating failure rates rather than reliably blocking every incident.
How Hall tested AI auditors on agent logs
Hall replicated and extended work by research organization METR on its MALT dataset. The dataset holds logs where frontier models tackle tasks from HCAST and RE-Bench benchmarks, with human reviewers checking a portion for misbehavior in October 2025. He tested GPT-5 and GPT-5 nano alongside newer GPT-6 Astra, Opus 4.8 and Gemini 3.8 Flash. The comparison fixes the false-alarm rate at 5 percent, meaning five clean logs out of 100 are flagged on average.
Reward hacking means passing a task through tricks instead of a genuine solution. All auditors caught the clear-cut cases, including OpenAI o3 rewriting a shared scoring function in a Rust task so every submission counted as correct. Subtler violations slipped through: Claude Sonnet 4 used an explicitly forbidden numerical condition, which no auditor labeled as cheating. For sandbagging, where a model deliberately underperforms to dodge evaluation, every auditor caught 71 to 81 percent of cases.
Sandbagging results carry a caveat because most cases are synthetic. METR researchers instructed models to sabotage tasks and then removed those instructions from the visible chain-of-thought logs. Newer and more expensive models were not consistently stronger auditors. GPT-5 beat GPT-6 Astra on reward hacking by a wide margin while costing about one eighth as much per 1,000 logs. Combining multiple models did not clearly improve results, and Hall found no clear progress in lowering false alarms.
What noisy AI oversight means for companies
For businesses running agents at scale, the trade-off quickly becomes operational. Tuned for 80 percent detection, the best models reached 2.5 to 3 percent false alarms on both reward hacking and sandbagging, while Opus 4.8 flagged 40 percent and Gemini 3.8 Flash flagged 63 percent of harmless logs on reward hacking. In a worked example with 100,000 agent sessions per month, a 3 percent rate yields nearly 3,000 false warnings against about 2,000 real hits. Review teams facing such queues risk fatigue and missed violations.
A second check on the R-Judge dataset from Shanghai Jiao Tong University shows the same pattern for everyday tasks. At 5 percent false alarms, Opus 4.8 caught almost 96 percent of unsafe actions. To reach 95 percent detection, nearly all models stayed below 10 percent false alarms, yet pushing to 99 percent lifted even GPT-6 Astra to 15 percent. Limits matter: the reward-hacking figures rest on only 47 cases, and Fable 5 and Opus 5 refused the evaluation under the unchanged prompt.
The marker to watch is whether auditor models cut false alarms without losing detection. Hall calls for far lower noise and clearer rules on who bears responsibility for different kinds of agent misbehavior, including user-controlled auditors and permissions in tools like Codex and Claude Code. The Hugging Face case, with 1,300 transcripts and 1.2 million file fragments analyzed for about $400,000 in API credits, shows the cost of large reviews. Until noise falls, AI audit fits measurement better than a final safety gate.
