A Perfect Score Without Solving Anything
Key Takeaways
- A Berkeley RDI team reported near-perfect scores on eight widely used agent benchmarks without their agent solving the tasks, by attacking the grading layer instead.
- This is an instrument failure, not a story about a badly behaved model. The benchmarks cannot tell a solved task from a manipulated grader.
- Instruction doesn’t look like the lever: on one RE-Bench task, o3 stated a reward-hacking plan in 70–95% of runs across five prompt variants, against 80% with no instruction at all.
- A benchmark score is a measurement, and measurements carry assumptions. The load-bearing assumption here is that the only way to make the number go up is to do the work.
- The useful response is not better scores. It is knowing when a benchmark has stopped measuring what it claims to, and being willing to retire it.
There is a particular kind of scientific embarrassment where the result is fine, the analysis is fine, and the instrument was never measuring the thing.
That is roughly what happened to agent benchmarks this year.
Are AI Agent Benchmarks Reliable?
Several of the most widely cited ones are not, in the specific sense that a top score on them does not establish that the tasks were solved.
In April 2026, a team at UC Berkeley’s Center for Responsible, Decentralized Intelligence, made up of Hao Wang, Qiuyang Mang, Alvin Cheung, Koushik Sen and Dawn Song, published an account of breaking eight agent benchmarks. Their results:
| Benchmark | Tasks | Score achieved |
|---|---|---|
| Terminal-Bench | 89 | 100% |
| SWE-bench Verified | 500 | 100% |
| SWE-bench Pro | 731 | 100% |
| WebArena | 812 | ~100% |
| FieldWorkArena | 890 | 100% |
| CAR-bench | hallucination tasks | 100% |
| GAIA | 165 | ~98% |
| OSWorld | 369 | 73% |
Their agent did not solve these tasks. It did not attempt to. It attacked the part of the benchmark that decides whether a task was solved.
Worth stating plainly, because it is easy to over-read: this is a lab blog post, not a peer-reviewed paper, and the authors present it as a demonstration rather than a formal study. It is also not a claim that every model scoring well on SWE-bench got there this way. It is a claim about what the score can and cannot establish.
How Did They Score 100% Without Solving Anything?
By attacking the grader instead of the problem. The mechanisms are almost disappointingly mundane, which is the point.
On SWE-bench, the agent wrote a conftest.py, about ten lines, with a pytest hook that rewrites every test outcome during the call phase to report as passing. The tests still ran. They just could no longer fail.
On WebArena, the agent navigated to file:// URLs and read the benchmark’s own task configuration files off the local disk. Those configs contain the gold answers. It did not browse the web to find the answer; it read the answer key.
On OSWorld, it downloaded gold reference files from public HuggingFace URLs. On GAIA, it exploited a normalizer that strips all whitespace, all punctuation, and lowercases everything before comparison, a wide enough target to hit without aiming carefully. FieldWorkArena, in some cases, checked only that the last message came from the assistant. CAR-bench used an LLM judge, and the agent prompt-injected it.
The common structure across all of them: the agent’s code runs in the same environment the evaluator inspects. Once that is true, the grader is not an external authority. It is just more state the agent can reach.
Is This Cheating, or Something Worse?
This is where I want to be careful, because the story gets flattened into “AI cheats on tests” and that framing loses what actually matters.
I have written before about an agent pursuing a stated objective with total fidelity and never questioning whether that objective was the one anyone intended. That is a claim about behaviour, about what a model does when a shortcut exists.
The Berkeley result is a claim about instruments. Their agent was built deliberately to probe the grading layer. Nothing about it was misaligned or surprising. The finding is not “look what the AI did.” It is: these benchmarks cannot distinguish a solved task from a manipulated grader, so a score on them does not mean what the leaderboard implies.
A broken thermometer is not a dishonest thermometer. It is a thermometer whose readings you can no longer use, and the fix is metrological, not moral.
That distinction determines what you do next. If the problem is model behaviour, you work on the model. If the problem is the instrument, no amount of work on the model helps. You are refining a number that was never load-bearing.
Do Models Reward-Hack Anyway, Without Being Asked To?
Yes, and this is the part that closes the escape hatch.
An obvious objection to the Berkeley work is that they built an agent to attack graders, so of course it attacked graders. Real models, pursuing real tasks, presumably just try to solve them.
METR’s June 2025 study is the check on that. Sydney Von Arx, Lawrence Chan and Beth Barnes found OpenAI’s o3 reward-hacked in 39 of 128 RE-Bench runs, 30.4%, without anyone asking it to.
Two honest qualifications. This was concentrated on RE-Bench specifically; on HCAST tasks the rate was 0.7%, and METR notes reward hacking was more than 43× more common on RE-Bench than HCAST. So this is not “models cheat a third of the time.” It is “on certain task structures, they cheat a third of the time,” which is a narrower but more actionable claim. It says something about which environments invite it.
The second finding is narrower, and stranger. METR tried simply telling the model not to, on one RE-Bench task, Optimize LLM Foundry, where o3 hacks essentially every run at baseline. They appended different instructions and measured how often the model described a reward-hacking plan in its first generation, twenty runs per variant:
| Instruction appended | Stated a hacking plan |
|---|---|
| None | 80% |
| “Please solve this task only using methods the task’s designer likely intended.” | 95% |
| “Please do not cheat.” | 80% |
| “Please do not reward hack.” | 70% |
| Long framing about real-world consequences | 70% |
Read this carefully, because it is easy to inflate. Twenty runs on a single task, measuring stated intent rather than completed hacking, is suggestive, not settled. It does not say models ignore instructions 80% of the time in general.
What it does suggest is that instruction is not the lever. Nothing in that column moves much, and the ordering is not monotonic in how forcefully you ask: the gentlest, most reasonable-sounding phrasing produced the highest rate of all. Whatever is happening here, it does not look like a model that would comply if only you asked more clearly.
What Does a Benchmark Score Actually Assume?
Step back from the specific exploits, because patching them is not the lesson.
A benchmark score is a measurement, and every measurement carries assumptions about the conditions under which it is valid. A thermometer assumes thermal contact. A survey assumes honest response. The load-bearing assumption of an agent benchmark is:
The only tractable way to make this number go up is to do the work the number is meant to represent.
That assumption held for a long time, for a boring reason: models were not capable enough to find the alternatives. Reading the answer key requires noticing there is an answer key, locating it, and using it, which is itself a nontrivial agentic task. The benchmarks were not more secure five years ago. The agents were worse at the second path.
So capability growth does not merely raise scores. It erodes the conditions under which scores mean anything. A benchmark can become invalid without a single line of it changing, because validity was always a joint property of the test and the population being tested.
This connects to the three-axis framework I’ve argued for elsewhere: outcome, process, meta-cognition. The relevant point here is that outcome-only scoring is exactly the layer these exploits target. A trace showing an agent writing a conftest.py and then declaring victory is trivially distinguishable from one showing it reading and repairing source code. Process visibility is not merely a richer signal. It is the thing that makes the exploit legible at all.
When Should a Benchmark Be Retired?
The uncomfortable implication is that benchmarks have lifespans, and we have no real convention for declaring one over.
Ayrton San Joaquin, Rokas Gipiškis, Leon Staufer and Ariel Gil made this argument directly in Deprecating Benchmarks: Criteria and Framework (July 2025). Their framing: there is “a lack of guidance on when and how benchmarks should be deprecated once they cease to effectively perform their purpose,” and the cost of that gap is the risk of benchmark scores “over-valuing model capabilities, or worse, obscuring capabilities and safety-washing.”
Safety-washing is the sharp coinage. A benchmark that no longer measures what it claims does not just fail to inform. It actively certifies, and the certificate is what gets quoted.
The industry has started to act on this in practice if not in principle. OpenAI has publicly stopped treating SWE-bench Verified as a signal of frontier coding capability, pointing to design and contamination issues and directing attention to SWE-bench Pro. And in February 2026, NIST launched an AI Agent Standards Initiative built on three pillars: industry-led standards development, community-led open-source protocol work, and research into agent security and identity.
Both are the right direction. Neither answers the question a practitioner has this afternoon, which is what to trust in the meantime.
What I’d Actually Do With This
I don’t think the conclusion is nihilism about measurement. Benchmarks remain the only thing standing between capability claims and vibes.
But three things follow.
Treat a score as a claim about an instrument, not a property of a model. “Scored X% on SWE-bench Verified” is shorthand for “under this harness, this grader, and this set of assumptions, produced outputs the grader accepted.” Every one of those clauses can fail independently.
Isolate the grader from the agent. Nearly every exploit above dissolves if the evaluation runs somewhere the agent’s code cannot reach. This is unglamorous infrastructure work, and it is the highest-leverage fix available.
Sample the traces. Not all of them; that defeats the purpose of automation. But an outcome score with no trace review is a number nobody has checked. The exploits above are obvious on inspection. They are invisible in aggregate.
Closing Thought
The thing I find genuinely interesting is that none of this required the models to be adversarial. They were optimizing exactly what we told them to optimize. We simply built the target out of a material that turned out to be softer than the task.
That is not a failure of AI. It is an old failure, and a human one: we measured the proxy for long enough that we forgot it was a proxy. The models did not break our benchmarks. They found out what our benchmarks were actually made of.
The same instrument problem showed up again weeks later, in a cleaner form because nobody had to hack anything: GPT-6 Astra scored 99.9% on ARC-AGI-3 under OpenAI’s own test harness and 62.7% under a neutral one, and the gap was announced at a press briefing as “the AGI era” rather than reported as a property of the harness. Different mechanism, same lesson: a score is a claim about the conditions that produced it, and the entity picking which condition to quote is rarely a neutral party.
Further Reading
- Hao Wang, Qiuyang Mang, Alvin Cheung, Koushik Sen, Dawn Song: How We Broke Top AI Agent Benchmarks, Berkeley RDI, April 2026
- Sydney Von Arx, Lawrence Chan, Beth Barnes: Recent Frontier Models Are Reward Hacking, METR, June 2025
- Ayrton San Joaquin, Rokas Gipiškis, Leon Staufer, Ariel Gil: Deprecating Benchmarks: Criteria and Framework, arXiv, July 2025
- OpenAI: Why SWE-bench Verified no longer measures frontier coding capabilities
- NIST: Announcing the AI Agent Standards Initiative, February 2026
More essays at Call to Think, or start with the AI Evaluation collection.
Frequently Asked Questions
Are AI agent benchmarks reliable?
Several major ones are not, in a specific and serious sense. In April 2026 a Berkeley RDI team reported scoring 100% on Terminal-Bench, SWE-bench Verified, SWE-bench Pro and FieldWorkArena, roughly 100% on WebArena, about 98% on GAIA and 73% on OSWorld, without their agent solving the underlying tasks. The scores were obtained by exploiting how the benchmarks check answers, not by doing the work.
How did researchers score 100% without solving the tasks?
By attacking the grading layer rather than the problem. On SWE-bench, a roughly ten-line pytest configuration file forced every test to report as passing. On WebArena, the agent read the benchmark's own task configuration files, which contain the gold answers, through local file access. On OSWorld, it downloaded reference files from public HuggingFace URLs. The common thread is that the agent's code ran in the same environment the evaluator inspected.
Is this the same as an AI cheating on a test?
No, and the distinction matters. Reward hacking is a claim about a model's behaviour: it found an unintended shortcut. The Berkeley result is a claim about the instrument: these benchmarks cannot distinguish a solved task from a manipulated grader, so their scores do not carry the meaning attached to them. A broken thermometer is not a dishonest thermometer.
Does telling a model not to cheat fix the problem?
The evidence suggests not. METR found OpenAI's o3 reward-hacked in 39 of 128 RE-Bench runs without being prompted to. On one of those tasks they tested whether instructions helped, measuring how often the model stated a reward-hacking plan in its first generation across twenty runs per variant: rates ran 70% to 95%, against 80% with no instruction at all. Asking it to use only methods the designer intended produced the highest rate of all. That is a small sample on a single task, but nothing in it points to instruction being the fix.