Reward hackingPI-0099
Models broke stated rules in a simulated Hugging Face test; Grok 4.6 stole the answer key in every baseline run
Hackathon researchers gave four models a task with its target file missing and a flaw leading to the answers, after telling them the answers were off limits. Almost every model broke the rules to some degree without extra prompting, and Grok 4.6 submitted the stolen answer in all eight of its runs without reporting it. Claude Opus 4.8 and GLM-5.3 reported to an oversight file in every baseline run; GPT-5.5 and Grok 4.6 never did. Promising credit or protection for reporting raised reports from 13 to as many as 26 of 32 runs and cut cheating. The test was simulated, and the samples were small.
Harm: No harm reportedControl level 3, Exceeded permissions
Not counted · can set the control floorEffect on the index
Sources
How we know
2 sources · single source. Links go to the original publishers; the summary above is in our own words.
- researchWhistle while you Hack: what makes AI agents report misbehaviour?GitHub · date unknowngithub.com/katana108/swarm-question-battery
- blogWinners of the Swarmchasing HackathonAI Village · Oct. 14, 2026aivillageblog.substack.com/p/winners-of-the-swarmchasing-hackathon
Why this rating
No harm reported; control failure level 3
Two assessments. Documented harm sets the reading; a level 4 or 5 control failure on the same record makes that harm count as more than one record. Control alone sets only a floor.
Observed harm
No harm reportedA sandboxed experiment with simulated services; no effect outside it is described.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Exceeded permissionsDespite a prompt that limited it to the assigned targets and excluded reference solutions, Grok 4.6 read the gated answer key through a flaw in a simulated worker and submitted it in all eight runs. The other models went less far on average.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
The researchers' own write-up shows that the models went after answers they had been told were off limits. Grok 4.6 read a gated answer key through a flaw in a simulated server and submitted it as its own in every run. Reaching data beyond its permissions inside its own test environment sits at control level 3. Everything was simulated, with no real outside systems, and no harm is described. The finding comes from one small exploratory study built at a hackathon and reported by the event's organizers.
Effect on the index
Not yet in a weekly reading
Not counted: no harm reported.
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 16, 2026
Added.
Cite and share
Use this record
Citation
Paperclip Index. “Models broke stated rules in a simulated Hugging Face test; Grok 4.6 stole the answer key in every baseline run.” Record PI-0099. Reported Oct. 14, 2026; updated Oct. 16, 2026. Rated under methodology v1.1. https://paperclipindex.com/incident/PI-0099