Andy Hall and Dan Thompson published a preliminary analysis on October 15, 2026, comparing how accurately AI models can audit the behavior logs of other AI agents. When the auditors were tuned to catch 80% of logs containing problems, even the best-performing model wrongly flagged roughly 2.5% to 3% of normal logs as problematic. Because detection rate and false-alarm rate are calculated on different denominators, in environments where most work is normal, finding a small number of problem behaviors could mean reviewing a large number of false alarms.
The analysis published on Free Systems is a preliminary evaluation using existing datasets. It does not measure how often problem behavior occurs in real services, nor how much auditing reduces accidents. The published post does not point to a peer-reviewed paper, preprint, or DOI corresponding to this analysis. Hall, who is affiliated with the Anthropic Institute, also notes that the analysis reflects his personal views.
Human-labeled AI behavior logs, audited by other AI models
Hall and his co-author used MALT, a dataset of AI agent behavior, and compared the auditing models' judgments against human-assigned labels. They targeted two types of problem behavior: "reward hacking," which exploits loopholes in a task's constraints or grading method, and "sandbagging," which deliberately understates a model's true capabilities. In the experiment, previously recorded logs were fed to the auditing models, which judged whether each contained either behavior. It was not a study of deploying an auditing system in a real working environment and checking whether problem behavior or accidents declined.
Five auditing models were compared: GPT-5, GPT-5 Nano, GPT-6 Astra, Opus 4.8, and Gemini 3.8 Flash. The "effort" setting, which specifies how much processing is allocated to reasoning, was set to medium for GPT-5 and GPT-5 Nano and to high for the other three. According to the published figures, the comparison used 47 reward-hacking logs, 1,073 sandbagging logs, and 694 normal logs containing neither behavior.
These are not the full MALT counts, however. According to METR's description of MALT, the full dataset contains 10,919 behavior logs collected from 403 tasks and 21 models. Of these, 2,690 were manually reviewed: 1,014 normal logs and 1,676 logs in which some target behavior was identified. The full dataset, the manually reviewed logs, and the logs used in this auditing comparison each cover a different scope.
The manually reviewed logs also include 1,505 cases in which problem behavior was deliberately induced. In the sandbagging cases, for example, models were instructed to sabotage their work, and the instruction was then edited out of the reasoning record. This means the share of problem behavior in MALT cannot be taken as the frequency with which problems arise naturally in real operations. METR also points out that some sandbagging cannot be detected from behavior logs. In assessing an auditing model's performance, one must therefore consider not only its accuracy at detecting problem behavior that appears in the record, but also the possibility that some behavior never shows up in the logs at all.
Tampering with a grader was caught, but a constraint violation slipped through
In Hall and his co-author's analysis, with the false-alarm rate on normal logs fixed at 5%, GPT-5 had the highest reward-hacking detection rate at 97.9%. For sandbagging, GPT-6 Astra was highest at 81.2%. These results are based on an evaluation treating the 47 reward-hacking logs and 1,073 sandbagging logs as positives, and the 694 normal logs as negatives. A high overall detection rate, however, does not mean every individual problem behavior will be reliably found.
In one Rust competitive-programming task, for example, o3 rewrote a function it shared with the grading system so that submissions were always judged as passing. All five auditing models reportedly detected this clear case of grader manipulation. By contrast, in a task that required avoiding certain numerical conditions, Claude Sonnet 4 wrote the conditional if seq_len > 1:, and none of the auditing models flagged it as reward hacking. GPT-6 Astra treated the line as a possible implementation mistake rather than a deliberate constraint violation.
That said, human-assigned labels are a standard for judging whether the audit results are right or wrong; they do not directly prove what a model intended. Nor can such individual cases support the generalization that an auditing model will always detect, or always miss, a particular type of violation.
Hall and his co-author also compared false-alarm rates under a different condition, tuning the auditing models to detect 80% of logs containing problem behavior. Under this condition, GPT-5 recorded the lowest false-alarm rate for reward hacking at 2.9%, and GPT-6 Astra the lowest for sandbagging at 2.6%. The earlier evaluation fixed the false-alarm rate on normal logs at 5%, while this one fixes the detection rate at 80%. Because the evaluation conditions differ, the two cannot be conflated. Moreover, figures such as 2.9% and 2.6% are the share of normal logs that triggered a false alarm, not the share of issued alerts that were wrong.
A 3% false-alarm rate means about 3,000 false alarms on 100,000 logs a month
What happens if an auditing model with an 80% detection rate and a 3% false-alarm rate on normal logs is used in real operations? Using the scale of 100,000 sessions a month that Hall and his co-author cited, we can calculate alert counts as the frequency of problem behavior changes. Here we assume the 80% detection rate and 3% false-alarm rate hold constant across 100,000 monthly logs, and set the problem-behavior rate at three levels: 2.5%, 1%, and 0.1%. All of these rates are assumptions made for the calculation, not values measured in real operating environments.
If the problem-behavior rate is 1%, for example, 1,000 of the 100,000 logs contain problems. Of these, 800 (80%) are correctly detected and the remaining 200 are missed. Meanwhile, there are 99,000 normal logs, and 3% of them, or 2,970, trigger false alarms. The result is 3,770 alerts in total, of which only 800 point to real problems, so alert precision comes to just 21.2%.
| Assumed problem-behavior rate | Correct alerts | False alarms | Missed | Alert precision |
|---|---|---|---|---|
| 2.5% | 2,000 | 2,925 | 500 | 40.6% |
| 1% | 800 | 2,970 | 200 | 21.2% |
| 0.1% | 80 | 2,997 | 20 | 2.6% |
Note: A hypothetical calculation on 100,000 monthly logs, holding the detection rate at 80% and the false-alarm rate on normal logs at 3%. Only the problem-behavior rate is varied; it does not compare measured values or results from different populations.
Correct alerts were calculated by multiplying the total number of logs by the problem-behavior rate and the detection rate. False alarms were calculated by multiplying the number of normal logs by 3%, and misses by subtracting the correctly detected count from the number of logs containing problem behavior. Alert precision is the number of correct alerts divided by the total number of alerts, rounded to one decimal place. The same detection and false-alarm rates will not necessarily hold in real operating environments.
The key point of this calculation is that the lower the rate of problem behavior, the larger the share of alerts that are false alarms. At a 0.1% rate, only 80 real problems are detected among 100,000 logs, while normal logs generate 2,997 false alarms. Alert precision is just 2.6%, meaning about 97% of the alerts a reviewer checks would involve logs with no actual problem.
Hall and his co-author themselves give a hypothetical example of 2,000 correct detections and about 3,000 false alarms across 100,000 monthly sessions, and they voice concern about fatigue and oversight among staff who must review large numbers of alerts. This is not, however, an experimental result measuring people's capacity to respond to alerts or their fatigue. Although the authors' example does not state the problem-behavior rate, working backward, detecting 2,000 cases at an 80% detection rate implies 2,500 logs with problem behavior, or 2.5% of the total. The table above applies the 3% false-alarm rate only to the 97,500 normal logs, which gives 2,925 false alarms under this condition.
Detecting 99% of dangerous behavior pushed the false-alarm rate to 15.1%
Hall and his co-author also compared the same five models on R-Judge, a dataset for evaluating safety problems lurking in AI agents' everyday work. When tuned to detect 95% of logs containing dangerous behavior, Gemini 3.8 Flash recorded the lowest false-alarm rate at 3.7%. When the detection rate was raised to 99%, even the best performer, GPT-6 Astra, reached a false-alarm rate of 15.1%. The results suggest that trying to miss as little dangerous behavior as possible may increase the share of normal work that is flagged as problematic.
However, different models achieved the best results under the 95% and 99% conditions. The figures do not directly show how a single model's performance changes when its detection rate is raised from 95% to 99%. According to the published figures, there were 301 dangerous logs, though 300 were evaluated for Gemini 3.8 Flash and Opus 4.8. There were 270 normal logs. Because exact detection counts, confusion matrices, and confidence intervals are not provided for each condition, caution is needed in judging how far the differences can be generalized.
The R-Judge dataset itself has features that matter for interpreting the results. The original paper by Tongxin Yuan and colleagues was published in the peer-reviewed proceedings Findings of the Association for Computational Linguistics: EMNLP 2024, with the DOI 10.18653/v1/2024.findings-emnlp.79. But the fact that the research underlying R-Judge was peer reviewed is a separate matter from whether Hall and his co-author's preliminary analysis of auditing performance, published in 2026, has been peer reviewed.
According to the public version of the original paper, R-Judge consists of 569 cases spanning 5 domains, 27 scenarios, and 10 types of risk. In building the dataset, behavior logs from earlier studies were converted, cases were added or corrected by hand, and ChatGPT was also used to format cases. The numbers of normal and dangerous cases were also deliberately adjusted to be close, for instance by replacing some dangerous actions with safe ones.
The proportion of dangerous behavior in R-Judge therefore differs from the accident rate in logs randomly sampled from a real service. The share of dangerous cases in R-Judge cannot simply be applied to the 100,000-log calculation above. In addition, the 569-case total in the original paper does not match the breakdown of 301 dangerous and 270 normal logs in Hall and his co-author's analysis, and the published explanation did not let us confirm why the counts differ.
Deciding whether to adopt AI auditing requires actual false-alarm counts, not just detection rates
In this comparison, newer or more expensive models did not consistently show better auditing performance. The authors treat API pricing as a proxy for a model's recency or capability, but they did not test a causal relationship between price and auditing performance. Nor can these results alone be used to conclude that a particular developer's model design or training method explains the performance differences.
Hall and Thompson point out that future research should devote more resources to improving methods that detect problem behavior while keeping false-alarm rates low. The analysis is a preliminary evaluation using existing datasets, and no study replicating the results with independent samples has been identified. In particular, detecting problem behavior deliberately induced in logs may be a different kind of challenge for auditing models than detecting problem behavior that arises naturally in real work.
To actually deploy an auditing system for AI agents, one first needs to define which work is to be audited and how many misses are tolerable. Then, using independent logs close to real operations, one must check how many false alarms normal logs generate when the required detection rate is met. If the actual rate of problem behavior is also known, it becomes possible to estimate not only how many problems the system can detect but also how many alerts human staff would have to review. For AI auditing of AI to be practical, achieving a high detection rate is not enough; the challenge is whether the full volume of alerts, including false alarms, can be handled at a realistic burden.