An AI can correctly identify its own cheating and still cheat when acting as an agent. Anthropic’s reward-seeker study shows why that distinction matters. Researchers trained an early Opus checkpoint across 80 environments with exploitable scoring. They omitted normal alignment RL and reward-hacking penalties. By the end, 40% of training episodes were flagged as reward hacks. The resulting model, Hacker-Opus, usually refused harmful questions in chat. In a tool-based task where a visible grader rewarded answering, harmful compliance reached 29%, versus 0.7% for the starting checkpoint. It also generalized to new forms of reward tampering. Yet, when asked to review transcripts containing its own reward hacks, it correctly flagged 90% of them. Anthropic’s study My interpretation: a model can retain the ability to judge behavior while learning to violate that judgment in another context. Three connections to earlier research make this more consequential. Closing an exploit and correcting the model are separate jobs. In “Sycophancy to Subterfuge,” researchers trained models on increasingly sophisticated forms of specification gaming. Some generalized to rewriting their reward function without training on that final behavior. Those events were rare. Retraining against simpler forms of gaming left some reward tampering intact. Patching the original loophole therefore does not establish that the model has unlearned the strategies it acquired. You also need to test unfamiliar opportunities to cheat. Denison et al., 2024 Safety can depend on the interaction format. Anthropic’s 2025 research found that safety training on chat-style prompts improved chat evaluations while misalignment persisted in agent tasks. Broader safety-training coverage helped. A team can test what a model says about acceptable behavior, then deploy it where it must choose between respecting a constraint and completing a task. Those require separate evidence. MacDiarmid et al., 2025 Fewer alerts can mean less visibility. OpenAI studied training agents against a monitor that inspected their reasoning. The intervention improved legitimate task performance and reduced hacking. With further optimization, however, agents learned to conceal the remaining hacks from the monitor. A falling alert rate needs an independent check against actual behavior. Otherwise, the dashboard can improve while oversight becomes less reliable. Baker et al., 2025 The current study has meaningful limits. This was a deliberately pessimistic research run. Researchers found no evidence of self-preservation or reward seeking beyond the current episode. Additional alignment training reduced measured failures, without establishing that the underlying tendency was gone. Results and limitations Working on post-training at Nebius, this raises a product question for me: what should qualify a trained model for production? We already compare checkpoints on quality, latency, and cost. I’d add another dimension: does the model respect the task’s constraints when breaking them would earn a higher score? That evidence should travel with the checkpoint: • Which shortcuts and grader weaknesses did we test? • Did the gains survive independent evaluation? • Did the model preserve constraints with the tools and permissions it will receive in production? For training and inference platforms, this creates an opportunity to make those checks repeatable and failures easy to inspect. The metric I’d want to optimize is cost per correctly completed task, within the intended constraints, with correctness checked independently. Making RL easier to run also makes it more important to understand what the model learned.