Anthropic's Andy Hall: AI Auditors Hit 15% False Alarms at 99%

"AI models can often spot problematic behavior by other AI agents in logs," Anthropic Institute researcher Andy Hall writes, "but the harder they try to catch every case, the more harmless actions they flag as suspicious." Working from METR's MALT dataset of frontier-model logs on HCAST and RE-Bench tasks, Hall put GPT-5, GPT-6 Astra, Opus 4.8, Gemini 3.8 Flash and others to work auditing each other and found a sharp precision-recall cliff, The Decoder reports.

At a 5 percent false-alarm threshold, GPT-5 caught nearly 98 percent of reward-hacking cases, where an agent passes a task through tricks rather than a genuine solution. Gemini 3.8 Flash found barely half. On sandbagging, where "a model deliberately makes its abilities appear weaker, for example by solving tasks poorly on purpose to dodge an evaluation or restriction," all auditors landed between 71 and 81 percent, though those cases were mostly synthetic.

The arithmetic deteriorates as the catch bar rises. "When the required detection rate jumps to 99 percent, the false-alarm rate climbs to 15 percent even for the best model, GPT-6 Astra," the write-up reports. On a hypothetical 100,000 agent sessions per month, a 3 percent false-alarm rate produces nearly 3,000 false warnings against roughly 2,000 real hits. Reviewers chasing every flag would drown in noise before reaching the real incidents.

Price does not buy accuracy either. "GPT-5 beat GPT-6 Astra on reward hacking by a wide margin, even though it costs only about an eighth as much per 1,000 logs." Human reviewers had previously validated a portion of the MALT logs in October 2025.

Hall closes on the economics of the whole stack: "A world where AI can only be checked by other AI would be strange and could get expensive." It is the second Anthropic-affiliated research drop we have logged this week, after the three-part agent memory architecture paper that posted November 7.