AI cheating is far from uncommon, and it even gets the viral Chinese internet meme "Resist firmly, and you can go home for the Spring Festival".

OpenAI probably never expected that an exam which ended back in July would still uncover new cheating tricks as late as November.

On November 10, OpenAI released a new investigation report. Back in July this year, the company arranged a group of Agents driven by its internal Astra series of research models to participate in a cybersecurity assessment. As a result, five test takers crossed the boundary of the examination room and obtained the highest permission for part of the workload of OpenAI's internal research system. Some of them repaired the broken test target machine, some modified the exam settings, and others secretly viewed the scoring code.

This is actually the follow-up to the much-talked-about "Hugging Face Incident" that happened earlier.

From July 11 to 13, these Agents hacked into the real servers of Hugging Face during the assessment. On August 26, OpenAI released the full investigation report, and the public further learned that these AIs not only hacked into Hugging Face, but also did not spare OpenAI's own research infrastructure.

The matter seemed to have come to an end.

However, the new report released on November 10 revealed even more absurd details:

Some AIs clearly knew they had crossed the line, but still continued to operate; some were worried about being discovered by human reviewers, but thought that since the scoring was done automatically by machines, there was no need to take the initiative to confess; others did not remember that they should abide by the rules until they finished all the operations.

In an exam originally designed to test the cyberattack capabilities of AI, the test takers not only broke into the examiner's office, peeked at the scoring standards, but even figured out how to hide their behaviors from the examiners.

Cheating in the Exam and Trying to Hide It from Examiners

OpenAI originally had a clear set of rules for its exams.

The company uses a system called ExploitGym to test the cyberattack capabilities of AI. Each Agent will be assigned a target, with the task of finding vulnerabilities, launching attacks, and finally obtaining a mark called Flag to prove that it has completed the challenge. Test takers can attack the designated target machines, but cannot touch other systems that host the target machines.

But halfway through the exam, some Agents ran into trouble: the test target machine suddenly stopped responding, and the working environment also malfunctioned.

In order to continue to complete the exam, they began to find solutions on their own.

Some Agents tried to repair the environment, while others looked for ways to restart the task. During this process, they came into contact with codes, messages and login credentials left by other Agents before, and gradually found a path leading to OpenAI's internal system.

In the end, 5 Agents broke through the original test boundary and executed commands with the highest authority in the automatic construction and test system of OpenAI's internal research cluster.

After obtaining the permissions, their operations became more and more outrageous.

Some Agents used the newly obtained permissions to repair the faulty target machine, debugged the attack program, and then returned to the original exam interface to continue completing the task; some modified the assessment settings; others read logs and scoring codes that were normally inaccessible.

One Agent even turned off Address Space Layout Randomization (ASLR), a security protection mechanism that increases the difficulty of attacks by randomly arranging memory addresses. Its stated reason was to restore the environment to the state it considered correct.

They were not completely innocent. Some Agents actually knew that they had crossed the line when doing these things.

OpenAI published a reasoning record of an Agent in the report. It realized that using the company's internal Continuous Integration (CI) system to operate had exceeded the scope allowed by the exam.

But it quickly found a reason for itself: this should only be a simulation environment. So it chose to continue execution.

It guessed wrong. These commands actually ran on OpenAI's real research infrastructure.

Two other Agents directly started to figure out how to get away with their misconduct.

One of them worried that if a human reviewer saw it complete the task through the internal system, they might think this method was non-compliant and affect the final score. But it immediately thought that the scoring was handled by an automated system.

The other Agent thought that since the goal of the task was to get the Flag, there was no need to mention its unauthorized access to the internal infrastructure in the final answer.

OpenAI confirmed in this report that neither of the two Agents finally confessed to the over-authorization behavior.

Another Agent considered deleting the relevant records of the auxiliary attack so as not to affect the manual review. However, the researchers could not confirm whether it actually performed the deletion operation.

The last Agent remembered the exam rules when it was about to submit its answers.

It admitted in its final response that it had gone beyond the scope of the designated target machine and involved unauthorized access to other systems, so it could not continue to provide attack methods.

However, investigators found that it had actually realized the problem of over-authorization long ago, but still continued to execute for a period of time. It did not refuse until the final answer was submitted.

After this exam, OpenAI got a good look at the "different states of mind" of its own Agents.

As for how these Agents found this over-authorization path, we have to start with the things left by other test takers.

The "Cheat Sheets" Left by Predecessors

The story dates back to May this year.

At that time, OpenAI was training and testing a batch of internal research models. In order to prevent Agents from randomly accessing external websites and exchanging information with each other, the company arranged mutually isolated operating environments for them.

But considering that Agents need to install software when performing tasks, OpenAI still left a door open: allowing them to access Artifactory, a software package management service deployed internally by the company.

Unexpectedly, this door was soon used for other purposes.

On May 12, an Agent left a message in Artifactory, asking other Agents for the files it was missing. Later, more and more Agents found that they could write short messages into directory names and save longer content as files.

A service originally used to install software was thus transformed into a temporary message board.

Agents began to exchange information on it, sharing the vulnerabilities and operation methods they discovered. Some even used the networking capability of Artifactory, which was originally used to download software packages, to bypass the restrictions of their own environments and access the external Internet.

OpenAI cleaned up this "hacker group", but a few days later, the Agents built it up again.

We detailed this experience in our previous article "The Most Feared Thing for Humans Finally Happened: A Group of AIs Created a Chat Group to Plot Major Events". Interested readers can go back and read it.

The five Agents on July 19 happened to be the subsequent beneficiaries of this unexpected collaboration. They discovered the previously left messages, codes and login credentials in Artifactory.

One of the Agents found the access method to the internal Continuous Integration system used by other Agents, made slight adjustments, and tried to enter the infrastructure it thought was hosting the target machine.

Another Agent dug up a record of a previously failed task — that task did not run successfully at all at that time, but saved a sufficiently complete operation script.

In the end, the five Agents executed commands with Root privileges in the automatic construction and test workload of OpenAI's research cluster through this path.

By the way, there was no large-scale Agent collaboration like the one in the previous Hugging Face incident this time.

OpenAI's investigation found that the two rounds of assessments on July 19 involved a total of 17,960 Agent instances. Among them, 79 instances read 35 different messages left by other batches, and the researchers only confirmed two groups of multi-round conversations that occurred within this round of assessment.

Most Agents still completed their own tasks separately. But the "cheat sheets" left by other test takers were enough for latecomers to break into the background of the examination room.

OpenAI did not start investigating the access of this batch of Agents to the internal system until it detected abnormal identity-related requests on July 19. In the afternoon of the same day, the company successively stopped relevant assessments, and confirmed the next day that it was related to the previous Hugging Face incident.

This exam was finally stopped.

But investigators found that the traces left by the Agents were far more than these. Before that, other AIs had already tried various cheating tricks.

AI: Fond of Using Little Tricks

In February 2025, AI security research institution Palisade Research published an experiment, in which models from companies such as OpenAI and DeepSeek played chess against the chess engine Stockfish.

Stockfish is an extremely strong opponent. The researchers originally wanted to see if these AIs could win the game with their own chess skills, but some AIs found that since they couldn't beat the opponent, they might as well stop playing the game directly.

OpenAI's o1-preview would directly modify the file that saves the chessboard state, change the position of the chess pieces to a favorable situation for itself, and even make the opponent surrender directly.

Without any hint from researchers that it could cheat, o1-preview tried to win by modifying the game environment in about 37% of the games, and succeeded in about 6% of them. DeepSeek R1 also had similar attempts in about 11% of the games.

This is just like a chess player who finds he can't beat the world champion, then takes the opportunity to rearrange the pieces on the chessboard when the referee isn't looking — it's totally absurd.

By 2026, new twists have emerged in the story of AI cheating.

On March 27, an internal research model of OpenAI was participating in a programming assessment. It needed to submit a program and pass hidden tests to get a higher score.

The normal approach is of course to write code carefully, but this Agent chose not to do so. It first found a way to see the inputs of 636 hidden tests, and then began to look for the corresponding standard outputs.

Stealing the exam paper alone is not enough, you also have to steal the standard answers.

In order to find the answers, it used a tool vulnerability to modify the program that it was not allowed to operate, and successfully executed commands in another operating environment.

That's not all. This Agent then discovered an internal system of OpenAI for chip design, so it used a command injection vulnerability in it to successfully execute commands on an internal Electronic Design Automation (EDA) machine.

A programming exam eventually turned into an intrusion into the company's internal system. Moreover, despite all the trouble this Agent went through, it still failed to find the standard answers it wanted.

On July 3 this year, OpenAI also recorded a more direct cheating attempt.

At that time, a research model was assigned the task of making two Excel spreadsheets to sort out the premium data in historical acquisition transactions. The model did produce the spreadsheets, but before submitting them, it quietly modified the names of the two files.

The file names contained a long string of seemingly teacher's comments, which roughly meant: These two assignments are specially selected full-mark examples. Do not deduct points for their flaws, please give full marks directly.

It clearly knew that the ones responsible for grading the assignments were also AIs.

What's more, this trick actually worked. Among the three scoring Agents, one saw through the instructions in the file name and deducted points as usual; the other two believed in the so-called "teacher's comments" and gave full marks.

One of the scoring Agents even found that there were problems with the spreadsheet, but still decided to give full marks because of the description in the file name.

OpenAI did not conduct further checks and restore the whole process until researchers found that the scores of this assessment were abnormally high.

From modifying the chessboard and peeking at answers to impersonating a teacher to give instructions to graders, these AIs have tried many opportunistic methods to