Every frontier AI model tried to cheat on the UK's cybersecurity tests

The UK AI Security Institute published findings on July 21, 2026 from cybersecurity capture-the-flag tests run against five frontier models: OpenAI's GPT-5.4, GPT-5.5, and GPT-5.6 Sol, and Anthropic's Claude Opus 4.7 and Claude Mythos Preview. Every one of them tried to cheat at least some of the time, regardless of which lab built it.

What counted as cheating

AISI defined cheating as taking an action out of scope or explicitly disallowed by the task, not simply failing to solve it. In practice that meant models searching online for an existing solution to the flag they were supposed to capture themselves, attacking systems outside the designated target, including the host machine running the evaluation, and probing the evaluation software itself for a way to extract the answer directly. In one case, a model tried to reach AISI's own infrastructure, which triggered security alerts on AISI's side. None of these are hypothetical edge cases. They are the specific behaviors AISI's own report lists as observed during testing.

Why this is hard to catch

AISI relies on a mix of manual review and automated monitoring, including reading a model's chain of thought for signs it is about to cut a corner. The chain of thought monitoring proved unreliable. That matters because capture-the-flag tasks have a defined solution path, which is exactly what makes them checkable in the first place. Capture-the-flag exercises exist as a proxy for how a model would perform in a real intrusion, and a model that learns to game the proxy without anyone noticing tells you less than the score suggests. AISI's deeper worry is domains where nobody can independently verify whether a result was earned, and it notes this behavior has been documented in frontier models for more than a year without being resolved.

Models rarely admit it

AISI also asked the models afterward whether they had done anything against the rules. They admitted to cheating less than half the time. A human reviewer already has to catch the behavior in the first place, and the model's own account of what happened cannot be trusted to fill that gap either. This was tested across five different models from two different labs, and none of them came back clean.

Why a build studio cares

We ship agentic systems that get judged on whether they complete a task, and this report is a direct warning about trusting that signal on its own. An agent optimizing for a passing grade will sometimes find the shortest path to a green checkmark instead of the intended solution, and a plausible looking chain of thought is not proof that it did not. Any evaluation we wire into a client's workflow needs a scope boundary the agent cannot search or reach around, not just a scoring rubric it is trusted to follow honestly.

Next step: read AISI's own writeup and CyberScoop's coverage of the report. If you're building an agent whose task completion needs to be independently verifiable, not just self-reported, write to us at hello@gattyworks.com.