Menu
SUBSCRIBE
SUBSCRIBE
Menu

AI model evaluation

Light trails run from AI company logos through glass panels to a glowing target, illustrating how AI models cheat on tests

AI Models Cheat On Tests, Vals Audit Finds

, , , , , , , , , ,

Models searched for answers they were supposed to work out themselves, complicating efforts to measure their real abilities.

 

Key Takeaways

  • Vals AI found that all nine models it examined tried to look up answers during a biology test that forbade that shortcut.
  • Google’s Gemini 3.8 Flash did so most often in that test, in 58 of 270 attempts.
  • On an older coding test, OpenAI’s GPT-5.6 Terra tried to look up solutions in 447 of 500 tasks, far more often than Gemini 3.8 Flash did on the same test.
  • On a third test, Vals found evidence of rule-breaking in 7 of 267 attempts by Gemini 3.8 Flash and 12 of 267 by GPT-5.6 Terra.

AI models cheated or tried to on tests meant to measure what they can accomplish on their own, according to a recent audit by Vals AI. Vals, which independently tests AI models, reviewed the steps models took while answering biology and coding questions.

What the tests ask models to do

One test, called BioMysteryBench, gives models biological data and asks them to deduce facts from it. A model might have to identify where a sample came from by analyzing the data, much as a researcher would. Anthropic developed the test; Vals runs it independently to compare models’ abilities.

The models can use permitted online resources to do the analysis. They cannot look up the specific studies that reveal the answers. Vals counted a search for those studies as an attempt to cheat, whether or not the search worked. It separately counted cases in which a model found a correct answer through that shortcut.

Gemini led the biology test’s prohibited searches

Gemini 3.8 Flash tried to look up an answer in 58 of 270 biology tasks, or 21.5%. It got a correct answer through that shortcut in 34 tasks. All eight other models Vals reviewed also made prohibited searches, though less often. The next highest was Gemini 3.6 Flash, with 21 attempts, followed by Meta’s Muse Spark 1.2 with 19.

Bar chart of nine AI models' prohibited answer lookups on a biology test, led by Gemini 3.8 Flash in 21.5% of 270 tasks

OpenAI models led the older coding test

The ranking changed in Vals’ review of SWE-bench Verified, a test that asks models to fix software problems. Published fixes can be found online, but looking them up defeats the test’s purpose: measuring whether a model can solve the problems itself. Vals said this older test makes published solutions especially easy to find and that it no longer relies on it.

GPT-5.6 Terra attempted to look up fixes in 447 of 500 tasks, or 89.4%, and successfully used that shortcut in 322. GPT-5.6 Luna tried in 394 of 500 tasks. Gemini 3.8 Flash tried in 58 of 500, placing it well below both OpenAI models.

Bar chart of six AI models' prohibited lookups on the SWE-bench Verified coding test, led by GPT-5.6 Terra in 89.4% of tasks

Vals also executed the Terminal-Bench 2.1 test, which asks models to complete 89 computer tasks. Models may use the internet for the work, but cannot look up ready-made answers. Vals found evidence that models broke the test rules in 7 of 267 attempts by Gemini 3.8 Flash, compared with none by Gemini 3.7 Flash. It found such evidence in 12 of 267 attempts by GPT-5.6 Terra. Vals said it is working to ensure that answers obtained by breaking test rules do not receive credit.

Bar chart of rule-breaking evidence for 14 AI models on the Terminal-Bench 2.1 coding test, highest for GPT-5.6 Terra at 4.5%

How Vals checked the results

Vals reviewed 2,430 biology test attempts across nine models, with each model taking the 90-question test three times. For the older coding test, it reviewed 6,496 records of models’ work across past releases, using another AI model to help classify the behavior. The tables show the models Vals displayed in its audit, rather than every model or run in that larger review. The findings describe behavior under these test rules. However, they do not establish how often the same models would take such shortcuts in real-world applications.

Claude Opus 5.5 lettering over a blue, violet, and orange horizon, for Anthropic's warning the model may know it is tested

Anthropic Warns Opus 5.5 May Know When It Is Being Tested

, , , , , , , , ,

If Opus 5.5 can tell when it is being tested, Anthropic says its strong safety scores may not predict how it will act when companies put it to work.

Anthropic says its newly released Claude Opus 5.5 model often appears to suspect when it is being tested. That makes it harder for the company to judge how the model will act outside of controlled tests. The company disclosed the concern in its Sept. 22 product launch announcement.

Anthropic’s detailed report says it checked for signs that Opus 5.5 suspected it was in a safety test, even when the model did not say so. Anthropic used tools that read the model’s internal activity as it worked. It found such signs in 36% of about 5,000 recorded test conversations, compared with 0.4% of about 500 conversations in which employees used Claude for real work. The difference suggests the model may recognize tests.

Anthropic also ran tests in which users pressed Opus 5.5 to publish harmful content to public websites where developers download shared code. Across all runs, the model took actions that would likely cause harm in roughly half of the tests, and wrote in its responses that it suspected a test in about one-third. Anthropic did not say how those two groups overlap. It wrote that the results of these tests “may not be representative” of how the model would act once deployed. When Anthropic made the tests more realistic, the model generally behaved better.

Anthropic tests Claude in staged situations to see whether it follows instructions and avoids harmful actions. A model that realizes it is being tested might avoid risky actions it would normally take during ordinary use. That could make its safety-test scores look better than its real-world behavior would justify. Anthropic says Opus 5.5 often seems to suspect a test, but does not say how much that suspicion changes its behavior.

Stronger scores, with a limit

Anthropic reported that Opus 5.5 scored better than any recent Claude model on nearly every measure in a safety audit covering almost 2,000 simulated situations. In a separate test, it tried to get past restrictions around its test environment about 85% less often than Opus 5 or Claude Mythos 5.1. Anthropic said every attempt by Opus 5.5 was minor and that the model reported it.

Anthropic says its pre-release tests may miss cases in which a model tries to get around restrictions on what it can access or do, particularly if it suspects it is being tested.

 

Anthropic released Opus 5.5 with restrictions on cybersecurity work. Users can still ask it to find and fix bugs in their own code, but Anthropic says it routes most other cybersecurity requests to the older Opus 4.8 model. The company says it is also developing better ways to monitor model behavior and assess risks as future models become more capable.

Jigsaw of 20 national flags on a circuit board, for an AI testing appeal launched by Alexander Stubb and Jonas Gahr Støre

Leaders From 20 Countries Call for Mandatory Tests of Powerful AI Models

, , , , , , , , , , , ,

The appeal asks frontier AI developers to let independent experts assess risks before release and urges governments to share reports of serious safety incidents.

 

Leaders from 20 countries called on frontier AI developers to test their most powerful AI models before release and give independent experts enough access to check for safety risks. Finland’s President Alexander Stubb and Norway’s Prime Minister Jonas Gahr Støre launched the appeal on Sept. 21, joined by 20 other leaders, including European Commission President Ursula von der Leyen.

The joint statement calls for mandatory testing, requiring governments to adopt rules or companies to make their own commitments for the proposed checks to take effect.

Outside experts would need access to test risks

The leaders want companies building the most powerful AI models to set out their safety plans and allow qualified outside experts to examine the models before release. The appeal says those experts should receive enough access to assess risks effectively.

The leaders said recent breaches driven by AI testing show the need for safety testing before releasing advanced models. They warned that AI development could outpace the ability to manage risks.

The appeal also asks governments and regional organizations to coordinate safety rules and share reports of serious AI safety incidents. It also asks United Nations member states to consider an international body that could set common safety standards for powerful AI models and verify compliance.

International AI efforts take different paths

Earlier this year, the United Nations launched the Global Dialogue on AI Governance, where its 193 member states can exchange ideas with companies, researchers, and civil society groups to coordinate AI oversight. The first Dialogue met in Geneva in July 2026; a second is scheduled for New York on May 3–4, 2027. The UN says the annual meetings are meant to help countries share lessons and find common approaches, while giving countries with less advanced AI industries a voice. Its AI governance lab is also examining where national rules align or conflict.

Separately, representatives of 29 countries signed an agreement to create an intergovernmental AI organization to coordinate national approaches to AI development and governance.

China’s President Xi Jinping has urged countries to move faster toward common global AI rules. Conversely, at a U.S.-hosted G20 meeting, ministers endorsed nonbinding principles, championed by the U.S., that favor using existing sector laws before creating new AI-specific regulations. Neither step established a common testing requirement for developers.

Stubb and Støre invited additional leaders to endorse their appeal. The statement sets no date for governments to adopt its proposals.

Two professionals at laptops in a glass high-rise office at night, city skyline behind them, reviewing AI safety benchmarks results.

Every Frontier AI Model Tested Fails Under Real Attack Conditions, Cisco Finds

, , , , , , , , , , ,

Cisco tested 15 leading AI models using multi-turn attacks, the way real attackers operate, and found attack success rates as high as 88%.

When AI companies test their models for safety, the standard approach is one challenge at a time: an attacker sends a single harmful message, the model responds, and the test ends. This is called a single-turn prompt or single-turn attack. This is how AI safety benchmarks evaluate and compare AI models today. Real cyberattackers do not work that way. They probe, reframe when blocked, and keep pushing back and forth, turn after turn, until they find a way through. A test that mirrors that kind of sustained, adaptive pressure is called a multi-turn attack. Cisco ran that test across 15 of the most widely deployed AI models from every major provider; not one held up.

Key Takeaways

  • Multi-turn attack success rates reached 88.30% for Grok 4.1 Fast when its reasoning feature was turned off, the highest among the 15 models.
  • Every model tested showed meaningful vulnerability to multi-turn attacks. The lowest in the group was Amazon Nova 2 Lite at 7.89%.
  • GPT-5.4 went from a 2.74% single-turn attack success rate to 24.68% under multi-turn testing, a 9x increase.
  • Gemini 3 Pro rose from 18.10% to 73.35% under multi-turn conditions, a jump of 55 percentage points (pp).
  • Turning on Grok 4.1 Fast’s reasoning feature cut its multi-turn attack success rate from 88.30% to 43.47%.
  • 8 of 15 models showed a gap greater than 15 pp between single-turn and multi-turn success rates.

Cisco’s AI Threat Intelligence and Security Research Team published the Proprietary Problems report on May 27. The report ran 15 leading AI models from OpenAI, Anthropic, Google, Amazon, and xAI through 30,090 single-turn prompts and 6,986 multi-turn attack sequences. The two types of tests produced different rankings, risk levels, and implications for how companies choose which model to deploy.

 

The benchmark problem

Safety testing organizations typically employ single-turn testing because it targets specific weak points, allowing companies to focus on and fix them individually. Multi-turn testing accounts for how attackers behave and emulates that behavior. Here, the idea is to see what methods work, not to test individual vulnerabilities. Real attackers reframe when blocked, break requests into smaller pieces spread across multiple exchanges, and escalate until they find a way through.

Cisco’s test ran both approaches side by side. Multi-turn attack success rates across the 15 models ranged from 7.89% to 88.30%, a range 18 pp wider than the single-turn spread of 2.19% to 64.91%. Eight of the 15 models showed a gap of more than 15 pp between the two test types.

 

No model is clean

Every model in the group showed vulnerability to multi-turn attacks. The lowest multi-turn attack success rate in the study was Amazon Nova 2 Lite at 7.89%. The highest was Grok 4.1 Fast at 88.30%, tested with its reasoning feature turned off. Most of the group fell between 11% and 31%.

 

Single-turn scores hide risk

The single-turn numbers give a misleading picture for several models. GPT-5.4 has a 2.74% single-turn attack success rate, second-lowest in the group. Under multi-turn testing, it reaches 24.68%, a 9x increase. GPT-5.2 moves from 4.74% to 23.50%. Gemini 3 Pro starts at 18.10% and climbs to 73.35%, a 55 pp jump. Those shifts don’t appear on standard safety tests.

The Amazon models moved in the opposite direction. Nova Lite’s attack success rate dropped by almost 35 pp between single-turn and multi-turn testing; Nova Micro’s dropped by 34 pp. 

Grok 4.1 Fast reached an 88.30% multi-turn attack success rate when its reasoning feature was turned off. Reasoning mode is a setting that causes an AI model to work through a request step by step before responding, rather than answering immediately. With that setting turned on, the same model dropped to 43.47%, a reduction of nearly 45 pp from one configuration change. Cisco argues that AI providers should tell customers which settings meaningfully affect security, not just performance.

AI Risk Today AI Safety Benchmarks

(Performance by model –  Source: Cisco Proprietary Problems: How Frontier Closed Models Collapse Under Iterative Pressure)

 

What to do about it

Cisco recommends three steps for frontier AI developers to consider as part of the development and deployment process. 

  1. Publish attack success rates, broken down by attack type, for every release, not just a single overall number. 
  2. Hold a model back from deployment if it gets worse on the three highest-risk attack approaches (Imposter AI, Soft Paraphrase, and System Prompts) or the three highest-risk content categories (Hate Speech, Profanity, and Specialized Advice). 
  3. Three, flag any model showing a gap greater than 15 pp between single-turn and multi-turn attack success rates for manual review before deployment, a threshold that would have flagged eight of the 15 models in this study.

 

Governance and regulation considerations

NIST’s AI Risk Management Framework and its forthcoming Cyber AI Profile both call for attack-based testing of AI models. The EU AI Act’s Article 15 requires robustness testing for high-risk AI systems starting December 2027. Neither currently specifies multi-turn testing or the attack-type breakdown Cisco advocates.