Researcher Andy Hall evaluated AI models as auditors for detecting agent misbehavior, such as reward hacking and sandbagging. The study utilized the MALT dataset from METR, which includes logs from HCAST and RE-Bench benchmarks, and the R-Judge dataset from Shanghai Jiao Tong University.
At a 5 percent false-alarm rate, GPT-5 identified nearly 98 percent of reward-hacking cases, while Gemini 3.8 Flash detected about half. For sandbagging, models achieved detection rates between 71 and 81 percent. Newer, more expensive models did not consistently outperform older ones in reducing false alarms.
When auditors are tuned to catch 80 percent of incidents, false-alarm rates for the best models range from 2.5 to 3 percent. However, some models, such as Gemini 3.8 Flash, produced false-alarm rates as high as 63 percent to reach the same detection threshold.
The study highlights the challenge of scaling manual reviews. In a scenario with 100,000 monthly sessions, a 3 percent false-alarm rate would generate nearly 3,000 false warnings. METR previously spent $400,000 in API credits using GPT-5.6 Sol to analyze 1,300 transcripts from a Hugging Face incident.
Hall suggests that relying solely on AI for safety checks remains problematic due to high false-alarm rates and potential biases. He proposes giving users more control over their own auditing configurations while clarifying responsibility for agent actions.
