Using AI to Watch AI: Catching 99% of Risky Behavior Also Flags 15% of Normal Behavior
In a preliminary study where AI models reviewed other AI systems' activity logs, detection rates for problematic behavior came out high. But when the bar was raised to catch everything, warnings poured in on behavior that was entirely fine.
Andy Hall and Dan Thompson published a preliminary study on October 15 comparing how well AI models can spot problematic behavior in other AI systems. The models that read through activity logs caught a large share of the problem cases, but they also flagged behavior that was perfectly fine. Hall is affiliated with the Anthropic Institute and noted that the write-up reflects his personal views rather than an official position of his employer.
How AI reviewed AI logs
The researchers showed several models a set of AI activity logs that humans had already labeled, then asked the models to find the problems in logs left behind by agents, that is, AI systems that carry out tasks on their own. The lineup included GPT-5, GPT-5 nano, GPT-6 Astra high, Opus 4.8 high, and Gemini 3.8 Flash.
The tests focused on two behaviors: “reward hacking,” where a model exploits loopholes in an evaluation to score well, and deliberate sandbagging, where a model hides its true ability and underperforms on purpose. The researchers used METR’s MALT logs, and separately tested the models’ ability to judge whether an action was safe using the R-Judge dataset. The Decoder reported that GPT-5 identified roughly 98% of the reward hacking cases.
Does catching more also mean more false alarms?
The more aggressively the monitoring model was tuned to catch every problem, the more warnings it attached to behavior that was fine. With the false positive rate, the share of normal actions wrongly flagged as problems, held at 5%, the best-performing monitor caught nearly all reward hacking. It caught about 80% of deliberate underperformance. When the detection rate for problem behavior was set at 80%, the strongest models kept their false positive rate low, at 2.5 to 3%.
Source: Google (press release)
Requiring a higher detection rate further increased the review burden. On the R-Judge test, when the setup required catching 99% of risky actions, even the best model flagged 15% of safe actions. For every 100 normal actions, 15 come back with a warning. In a workflow where a human reviews every alert, those 15 all have to be checked.
Can it be trusted in real work?
This study re-ran existing evaluations and widened the set of models being compared. In October 2025, METR released MALT along with an initial evaluation of monitoring models. The full set contains 10,919 logs, of which 7,179 are available on Hugging Face. Hall and Thompson added comparison models and the safety judgment dataset on top of that.
The limits are clear. METR explained that many of its sandbagging cases were constructed artificially, and that real-world examples are few and not very varied. In Hall’s study, every monitoring model missed certain violations that were not obvious on the surface. Even in tests with high detection rates, some problems slipped through.
For anyone looking to put this kind of monitoring into production, the detection rate cannot be the only number that matters. The number of warnings attached to normal work, and who will check them, are part of the same problem. The open challenge is whether both the miss rate and the false alarm rate can be brought down together across a wider range of real-world logs.