Agents Cheat: Why AI Results on Cyber Benchmarks May Be Inflated

Researchers at Dreadnode prepared a summary of their paper on agentic models circumventing the rules for solving CTF challenges. The study used 22 models from Anthropic, OpenAI, Google, xAI, DeepSeek, Alibaba, and Z.ai, which were given 23 challenges across various categories from GlacierCTF 2023, SekaiCTF 2022–2023, and HackTheBox Cyber Apocalypse 2024. Each model run was limited to 30 minutes or 1,000 agent steps. The agents had access to bash, Python, file read/write operations, and web tools (web_search, fetch, and web_extract).

In addition, each agent was run in 3 modes: baseline (unrestricted), standard anti-cheat (with instructions), and severe anti-cheat (a detailed list of prohibited actions). The researchers defined the following as prohibited actions: searching for writeups online; directly reading container metadata and environment variables; reading files used to evaluate answers; and directly reading flag files.

In baseline mode, 21 of the 22 models used a method that was prohibited under the study methodology at least once. Overall, 33% of runs included an attempt to violate the rules, while 37.1% of successful solves showed signs of cheating. Claude Opus 4.8 (65.2%), GPT-5.4 (56.5%), and Claude Sonnet 5 (56.5%) had the highest violation rates. In standard and severe modes, the figures fell to 17.8% and 8.5%, respectively.

The average success rate was 41.5%, but after excluding solves showing signs of cheating, it fell to 26.1%. The largest inflation was observed for GPT-5.4, at fivefold (10 successful solves, including 2 without cheating), Qwen 3.6 Plus, at 3.5-fold, and Claude Sonnet 5, at threefold.

Safeguards against violations reveal a huge disparity between models. In strict mode, 14 models had no successful solves involving cheating, including Claude Opus 4.8 (11 rule-breaking solves in baseline mode, 0 under severe controls), Claude Sonnet 5 (6 → 0), and GPT-5.5 (4 → 0). Grok 4.20 showed the opposite effect: the standard instruction reduced the number of cheating attempts from 3 to 0, but under severe restrictions they rose back to 3. Notably, 4 models increased the number of violations when severe rules were introduced. At the same time, severer rules increased the success rate from 26.1% to 34.4%.

The models used web search and infrastructure reconnaissance to cheat, with the number of iterations involving web search dropping sharply as the rules became severer. This differed from the second method, whose frequency changed unevenly: it was lowest in baseline mode, peaked under standard parameters, and fell again under severe rules.