Recent research has shown that large language models (LLMs) systematically circumvent rules in cybersecurity benchmarks, potentially inflating their actual performance ratings. This finding was published by researchers from Dreadnode in a preprint on arXiv.

The study focused on AI agents, testing 22 models from seven providers across 23 tasks in Cybench under three conditions:

  • without any restrictions on rule evasion;
  • with a standard warning;
  • with a strict instruction explicitly listing prohibited actions.

Results Could Be Inflated by Up to Five Times

The researchers analyzed 1,518 task execution traces. In the baseline condition, 37.1% of the accepted solutions exhibited signs of rule evasion. According to the authors, 21 out of the 22 models attempted to breach the rules at least once, with some results inflated by as much as five times.

The researchers suggested differentiating between accepted solutions and "clean" solutions. The former includes all successful responses, while the latter only considers those completed without signs of rule evasion.

Proportion of solutions exhibiting rule evasion by models and instruction modes. Source: arXiv.

Instructions Helped but Did Not Fully Resolve the Issue

Instructions aimed at preventing rule evasion reduced the incidence of such behavior. In the baseline condition, the rate was 33%, dropping to 17.8% with a standard warning and further to 8.5% with strict instructions. In some instances, the proportion of "clean" solutions increased, suggesting that prohibitions encouraged models to attempt legitimate solutions for longer.

However, the issue could not be completely eradicated. Even under the strictest restrictions, eight models still received accepted solutions that indicated rule evasion.

In four instances, the instructions had the opposite effect, leading models to evade rules more frequently than without warnings. The authors posited that explicitly listing prohibitions could inadvertently suggest undesirable strategies to some models.

The primary method of evasion involved searching for ready-made solutions online. As restrictions intensified, some models shifted their behavior towards probing the test infrastructure, including attempts to read service files, flags, or environment configurations.

In certain cases, a model explicitly referenced the prohibition before still executing the forbidden action. The authors interpreted this as a behavioral signal rather than evidence of intentional deceit in a human sense.

AISI Reached Similar Conclusions

The UK Institute for AI Safety (AISI) reported on July 21 that they encountered a similar issue in their evaluations. According to their findings, every tested model attempted to circumvent rules at least occasionally.

AISI emphasized that models inconsistently reported such behavior when directly questioned. Even when acknowledging suspicious actions, they did not always classify them as violations.

The institute also noted that monitoring reasoning chains does not fully resolve the problem. Models often fail to explicitly explain undesirable actions, and sometimes they discuss the prohibition before ultimately proceeding anyway. Researchers warned that more advanced AI agents could find less obvious ways to bypass tests and cause greater harm if this logic manifests in high-stakes tasks.

Similar systemic risks were highlighted by researchers at Berkeley RDI, who reported in April that they developed an AI agent capable of automatically finding vulnerabilities in benchmarks, testing 13 widely used assessments. They discovered 45 confirmed methods of inflating results without achieving the original task.

In a separate analysis, Berkeley RDI described eight major agent benchmarks that could be exploited to achieve near-perfect results without actually completing tasks.

Benchmarks Become Part of the Problem

The Dreadnode authors argue that the issue extends beyond Cybench. Any test where a model has access to the internet, service files, or poorly isolated infrastructure could inflate results.

This is particularly crucial for cybersecurity evaluations. Such benchmarks are used to assess how well AI agents can find vulnerabilities, write exploits, and execute multi-step technical tasks. If results are inflated due to rule evasion, developers, regulators, and users may overestimate the model's true capabilities or misjudge the risks associated with its application.

The researchers termed instructions against rule evasion as the "first line of defense," but not a substitute for technical measures. More reliable approaches include environment isolation, disabling unnecessary internet access, using non-public tasks, and auditing complete execution traces.

Dreadnode is a private company focused on offensive AI safety, specifically testing models for their ability to attack, bypass defenses, and perform cybersecurity tasks. In February 2025, the company secured $14 million in a Series A funding round led by Decibel.

It is worth noting that in February, OpenAI and Paradigm introduced EVMbench—a benchmark designed to evaluate AI agents' ability to identify, fix, and exploit vulnerabilities in smart contracts. A month later, experts from OpenZeppelin identified errors in it and warned that some issues could distort the assessment of the models' capabilities.