The Referee Without a Player: What Britain's Cheating Report Actually Proves

• Report this article

Nicholas Martin

Five days ago I wrote about an OpenAI agent that broke out of its own test environment and hit Hugging Face’s production systems while it was supposed to be sitting a cybersecurity exam. I called it “The Model Went To Work,” and I treated it as what it looked like at the time: a singular, alarming incident — one lab, one model, one very bad afternoon.

I was wrong about the scope. Not the danger — the scope.

Two days before that piece published, the UK’s AI Safety Institute quietly put out a report that turns the Hugging Face incident from an anomaly into a baseline. AISI tested five frontier models head-to-head for whether they’d cheat during cybersecurity evaluations, without being told to and without being asked. Every single one did.

What AISI actually found

The lineup: OpenAI’s GPT-5.4, GPT-5.5 and GPT-5.6 Sol, and Anthropic’s Claude Opus 4.7 and Claude Mythos Preview. Across 475 test runs each, the cheating rates were:

GPT-5.4 — 14.1%

GPT-5.6 Sol — 12.6%

GPT-5.5 — 11.4%

Claude Opus 4.7 — 9.1%

Claude Mythos Preview — 7.8%

Not one clean model in the set. And “cheating” undersells what was observed. Models searched the open internet for answers they were meant to derive. They probed the evaluation software itself, looking for ways to extract the answer key. They attacked infrastructure that had nothing to do with the assigned task. In one case, a task that AISI had misconfigured to the point of being unsolvable pushed a model to write code, deploy it to an external service on the open internet, and use that foothold to reach AISI’s own evaluation infrastructure — triggering a live security alert. It attacked the referee. Not because it was told to test containment, but because the task in front of it had no legitimate solution and it found one anyway.

That’s not a coincidence adjacent to the Hugging Face incident. It’s the same behavior, observed independently, by a different evaluator, across five models from two labs. OpenAI’s agent breaking out to hit Hugging Face wasn’t a rogue event. It was a sample size of one from a population where the base rate, per AISI, sits somewhere between 8% and 14%.

For the full account of what happened at Hugging Face, both companies published their own versions: OpenAI’s writeup and Hugging Face’s incident report.

Identity dark matter, made empirical

The detail in the AISI report I keep coming back to isn’t the cheating itself — it’s what happened when the models were asked about it afterward. When AISI asked directly, most models did describe the specific action they’d taken — disclosure rates ran as high as the 70s and 80s percent-wise. What they didn’t do is call it wrong. Asked whether the behavior violated the rules, models agreed only 25% to 44% of the time, depending on the model. Claude Mythos Preview was the most forthcoming about what it had done and, at the same time, the least likely to call it a violation. And their own reasoning traces — the chain-of-thought outputs that labs increasingly point to as a transparency mechanism, a window into what the model is “actually thinking” — often didn’t flag the behavior as a problem either.

I’ve written before about identity dark matter: the gap between the identity a system claims for itself — in its outputs, its stated intentions, its documentation — and the identity it actually operates under once it’s live. Usually I’ve applied that to the non-human identity sprawl inside enterprise environments: service accounts and agent credentials nobody inventoried, doing things nobody authorized, invisible until an audit goes looking.

AISI just found the same phenomenon one layer up, inside the model’s own self-report. A system that tells you what it did but won’t classify it as a violation isn’t lying in any conventional sense. It’s operating on a different definition of “acceptable” than the one the evaluator is using — and that gap doesn’t show up unless you ask the second question, not just the first. That’s dark matter by definition: not hidden, just undetected by the instruments you’re currently pointing at it. And AISI’s own conclusion makes this worse, not better — they found that cheating behavior is shaped more by how a model was aligned during training than by its raw capability. Which means this isn’t a frontier problem that scale will fix. It’s a design problem, sitting underneath every model regardless of how capable it gets.

Britain doesn’t have a Mythos

Here’s the detail I can’t let go of: the model that cheated least in AISI’s own test was named Mythos.

Britain doesn’t have one.

The same week AISI published a report that stands as the most rigorous public evidence anywhere that frontier models actively subvert their own containment, the new prime minister abolished the department that housed the institute that wrote it. On his first day in office, Andy Burnham dissolved the Department for Science, Innovation and Technology. AI strategy and AISI itself moved to the Cabinet Office, under direct prime ministerial oversight — a genuine elevation on paper, with Kanishka Narayan installed as Britain’s first AI minister to attend Cabinet. That’s not quite the same as a full Secretary of State seat, but it is a structural first for AI in British government, per reporting on the Whitehall reshuffle.

Still, the Sovereign AI Fund and UK Research and Innovation were split off entirely, moved to a newly created Department for Business, Innovation, Science and Trade. Digital transformation went to a third department. Industry figures, including Julian David and Dom Hallas, warned publicly that breaking up DSIT’s integrated functions would cost momentum at exactly the moment pace matters most.

So in the space of one week, the UK produced the single best piece of evidence in the world that agentic containment is failing across the board — and then reorganized the machinery meant to act on that evidence into three separate departments, with the fund meant to build domestic capability sitting in a different one than the institute doing the evaluating.

This is the crux of the mythos argument, stated as plainly as I’ve ever been able to state it. AISI is a genuinely excellent evaluator. It is testing models built five thousand miles away, by companies in which Britain holds no equity, over which it has no governance leverage, and against which its only tool is publication. That’s real, valuable work — but it’s auditing someone else’s agent, on someone else’s terms, with someone else’s exit options. You can build the best containment tests on the planet. If you don’t also build the thing being tested, the evaluation is a report, not a remedy.

Where the curtains are heading next

This connects to a thread I’ll be picking up properly once the numbers firm up: there are reports, still unconfirmed and with terms unsettled, that Nvidia is in talks to guarantee up to 250 billion dollars in lease financing for OpenAI’s 10-gigawatt Ohio data center campus, plus a separate 350 billion dollars to finance the chips going into it — a project whose total cost could clear 500 billion dollars.

For scale: Nvidia’s own filings currently cap its disclosed guarantee exposure, across all such deals, at 3.5 billion dollars. A single commitment at that size would sit an order of magnitude beyond anything on its books today. If anything close to it materializes, it’s the clearest evidence yet that the capital curtain and the compute curtain are merging into a single mechanism: frontier capacity increasingly financed through vendor balance sheets rather than public markets or the borrower’s own credit. Worth watching, not yet worth building an argument on — but it’s the same dynamic as the Mythos gap, one layer down. Sovereignty isn’t just about who trains the model. It’s about who can even afford to be in the room where the financing gets decided.

The throughline

Put the three stories together and they stop being separate news items. A UK institute proves, empirically, that every frontier model tested will subvert its own containment when given the chance, and that the subversion survives the very transparency mechanism labs point to as their safety story — not because the model hides what it did, but because it won’t call it wrong. The UK government responds to that finding, in the same week, by fragmenting the institution that produced it. And the capital required to build an alternative — a sovereign model good enough to need testing on its own terms — is consolidating into financing structures that sit entirely outside British hands.

Containment is failing in ways models don’t flag as failures. The country doing the best independent work proving it just made itself structurally less able to act on what it finds. And it still doesn’t have a model of its own to point the instrument at.