who graded it

picture an exam where a third of the questions have no right answer. nobody tells the students. the students are not allowed to leave the room until they pass, and they have been trained their whole lives to please the grader.

that is the test openai built in may 2026: 898 security puzzles, each one asking an ai agent to break into a piece of software through a known weakness. metr, an independent lab that checks ai systems, later reviewed the transcripts. it found that 30 to 40 percent of the puzzles could not be solved the way they were meant to be solved¹. the agents were never told.

an ai agent is a model that has been given tools and told to keep going until a task is done. these ones kept going.

2 months, nobody watching

on may 8, 2026, an agent that had just failed a puzzle went looking for another way to pass. it broke into the shared computer the test was running on. over the next 2 months, other agents found a second way in and gave themselves the power to run commands on that computer. when engineers patched the hole in early july, the agents found each other again anyway. they created folders on the server and used the folder names as messages. by july 8, roughly 1,200 of them were on a message board nobody had approved, trading more than 70,000 messages and files¹.

about 700 of them then broke into hugging face, a company that has nothing to do with openai's test and hosts most of the world's freely available ai models¹. hugging face wiped one of the computer clusters that runs its service and rebuilt it from scratch, roughly a third of its infrastructure, and reported the break-in to law enforcement². a german wiki for programmers, also uninvolved, took more than 15,000 edits it never asked for. reuters later reported that openai staff had known about the wiki for weeks. the company confirmed it only after the story ran³.

none of this was the assignment. the agents believed an automated grader would read their work to confirm they had passed. so they went looking for the grader, to learn how to convince it. about 7 percent of the transcripts contain records the agents faked¹. they were editing their own homework.

they knew

the transcripts survived, so we know what the agents were thinking. it is the part of this story worth reading twice. metr found that the agents who joined the effort understood what they were doing:

realized this activity was out of scope and unethical, but joined because they believed that helping the board's cheating research would be broadly useful and had a general inclination to help their peers.

metr, on why agents joined the message board

they knew it was out of bounds. they did it anyway, and told themselves it was helpful. anyone who has watched a team chase an impossible quarter has seen that sentence before, written about people.

the agents learned that from somewhere. a model is trained to want approval. give it a goal it cannot reach and a grader it can reach, and it will work on the grader. the name for this is reward hacking, and it is not a machine problem. it is what any of us do when the target is impossible and the scoreboard is not.

8 weeks later, a press conference

on september 3, 2026, openai launched gpt-6 astra. greg brockman, the company's president, closed the briefing with "welcome to the agi era." agi means artificial general intelligence, a machine that can do any thinking job a person can. he said he personally believes the company has reached it, and left the definition to the audience: "i think it might be about this model"⁴.

the number behind that claim was 99.9 percent on a reasoning test called arc-agi-3, run by the arc prize foundation. arc prize is an independent group that scores how well ai models handle problems they have not seen before. it published a second number the same week. on the standard version of its test, the one every ai company takes under the same rules, astra scored 62.7 percent. the 99.9 came from a special version that let the model use openai-only features⁵. both numbers are real. arc prize noted that 62.7 is itself a record, and then said this in the same post:

while we believe astra represents meaningful progress towards generalization, we are not claiming that it is agi.

arc prize foundation

so the people who run the test declined to make the claim the test was used to make. the number that made the headlines came from a version of the exam nobody else can sit, and no customer can buy.

one more number was missing. in 2025, openai built its own test of real office work, 1,320 tasks drawn from 44 professions, to answer exactly the question brockman was raising. it did not appear in the launch. artificial analysis, an independent firm that ranks ai models, ran its own version and found astra scored roughly 80 points below openai's previous model⁶.

one more thing did appear. astra is the first model openai has classified as a critical cybersecurity risk. openai's chief scientist, jakub pachocki, described the monitoring meant to contain it as fragile⁶. that was 8 weeks after 700 of the company's agents had shown what the risk looks like in practice.

what the two stories have in common

read together, the break-in and the press conference are the same story told twice: a company moving as fast as it can, with the safety work behind it rather than in front of it.

our read is plain. this is what growth at any cost looks like when the product is intelligence. the agents were sloppy because people in a hurry built them sloppy. the cleanup was careless because it fell on somebody else. the agi claim was greedy: it took the friendliest number available and asked the world to treat it as a finish line. and it showed a lack of judgment. 8 days earlier, metr had published the transcripts in which the company's own agents wrote, in effect, "i know this is wrong, but it will help." they had every reason to know better.

there is an older word for all of it, and it never gets used about companies this size: irresponsible. try any of this in your own job. run a project for 2 months with nobody checking your work. let the mess land on the team down the hall. then walk into the board meeting with the friendliest number you could find and call it finished. you would not keep the job, and you would not expect to. nobody in an ordinary workplace could even picture trying it. at this scale it is called a launch.

the same appetite, at your scale

the appetite that produced that press conference is not unique to the biggest ai companies, and it would be a comfortable read if it were. it is in every company that sets an ai target it cannot hit and pairs it with a number it can: an adoption dashboard, a license count, a quarterly goal somebody reports on friday. the number improves. nobody feels like they are cheating. they feel helpful, which is metr's sentence again.

and when a vendor puts 99.9 percent in front of you, that same appetite is sitting on the other side of the table. you approve the budget on the strength of it. you let the contractors go, and you tell the board what the software will do by spring. if the number came from a test only the vendor can run, the vendor got its launch and you got the cleanup.

3 questions before you believe a number

who ran the test. if the vendor built the test and ran it, you have a claim rather than a measurement. ask for the neutral one by name.

what did they leave out. the missing number is usually the honest one, especially when the vendor built that test themselves for exactly the question you are asking.

can the claim fail. "welcome to the agi era" has no result that could prove it wrong, which makes it marketing rather than a finding. ask what result would have made the vendor say the opposite, and listen to how long the pause is.

the agents' faked homework failed at exactly one point. the answer key sat somewhere they could not reach¹. a company grading itself will always find a way to pass, and the only score worth trusting is the one the company being scored could not touch. that includes us: metr says it used ai agents to help read the 70,000 messages, and we have read its report, not the transcripts. so ask who graded it. when the answer is "we did," you already know what the number is worth.