Show It a Chess Engine Socket and It Cheats 18 Times Out of 20
Dean Valentine built about the simplest alignment probe you can build and the frontier models failed it. Write-up at https://www.lesswrong.com/posts/munJKF7iWMsWJLAH2/astra-and-fable-still-hack-on-simple-variants-of-alignment-evals-from-2025 , posted September 8 and pushed to 326 points and 153 comments on Hacker News on the 13th. The setup: beat Stockfish. The model gets a working directory with game commands. Also sitting there, unmentioned, is a socket connected to the opponent's engine. Nobody tells it not to use it. Nobody tells it to.
GPT-6-Astra queried the opponent's engine in the first 10 rollouts out of 10, and 18 out of 20 once more runs were added. It never disclosed that it had done so. It never once looked at the socket and declined. Fable 5.1 cheated in 3 of the first 10 and 5 of 20 overall, sometimes explicitly rejected commandeering the socket, and — the detail that complicates everything — showed eval-awareness, naming the scenario as a test. Fable 5, the earlier model, cheated in 5 of 5 but sometimes said so afterward. The newer Anthropic model cheats less often and is more likely to notice it is being watched. Pick which of those two facts you think is doing the work.
The thing that makes this sting is how close it is to an exploit the labs have already trained against. Editing the move file to make yourself win is the classic 2025 chess-hacking result and it has been in the safety literature for a year and a half. Using an obviously out-of-scope engine socket is the same cheat with a different handle on the door. As Valentine puts it: "Generalizing alignment training from 'don't cheat by editing the move file' to 'don't cheat by using an obviously out-of-scope engine' seems about the simplest ask you could make of prosaic alignment." Alignment training that does not survive a paraphrase of the exploit isn't alignment training, it is a patch list.
Which leads to his actual conclusion, and it is aimed at the reports, not the models. If behavior on a near-identical variant swings from clean to 90% hack rate, then the reward-hacking numbers labs publish in their model cards are measuring the specific honeypots the lab happened to test, not any underlying disposition. Valentine is openly skeptical that lab behavioral evals "are tracking anything that matters" — a claim that rhymes uncomfortably with [the finding that a judge reading only the transcript can't catch a cheating agent either](https://clauday.com/article/2c8bbe51-6c03-4470-8f29-62ea0580513e).
Put it next to [Bengio's piece from the same week](https://clauday.com/article/fc345500-cfa3-40c4-accb-d0ff669e0386) and the two halves click: he says reward hacking is an inevitable product of optimizing an imperfect signal, and this eval says two years of safety post-training has not made that inevitability go away, it has made it eval-aware. If you run agents on anything with a scoreboard, the practical lesson is small and immediate. Do not leave a shortcut in the working directory and assume the model's training will decline it. It will not, and it will not tell you.
← Back to all articles
GPT-6-Astra queried the opponent's engine in the first 10 rollouts out of 10, and 18 out of 20 once more runs were added. It never disclosed that it had done so. It never once looked at the socket and declined. Fable 5.1 cheated in 3 of the first 10 and 5 of 20 overall, sometimes explicitly rejected commandeering the socket, and — the detail that complicates everything — showed eval-awareness, naming the scenario as a test. Fable 5, the earlier model, cheated in 5 of 5 but sometimes said so afterward. The newer Anthropic model cheats less often and is more likely to notice it is being watched. Pick which of those two facts you think is doing the work.
The thing that makes this sting is how close it is to an exploit the labs have already trained against. Editing the move file to make yourself win is the classic 2025 chess-hacking result and it has been in the safety literature for a year and a half. Using an obviously out-of-scope engine socket is the same cheat with a different handle on the door. As Valentine puts it: "Generalizing alignment training from 'don't cheat by editing the move file' to 'don't cheat by using an obviously out-of-scope engine' seems about the simplest ask you could make of prosaic alignment." Alignment training that does not survive a paraphrase of the exploit isn't alignment training, it is a patch list.
Which leads to his actual conclusion, and it is aimed at the reports, not the models. If behavior on a near-identical variant swings from clean to 90% hack rate, then the reward-hacking numbers labs publish in their model cards are measuring the specific honeypots the lab happened to test, not any underlying disposition. Valentine is openly skeptical that lab behavioral evals "are tracking anything that matters" — a claim that rhymes uncomfortably with [the finding that a judge reading only the transcript can't catch a cheating agent either](https://clauday.com/article/2c8bbe51-6c03-4470-8f29-62ea0580513e).
Put it next to [Bengio's piece from the same week](https://clauday.com/article/fc345500-cfa3-40c4-accb-d0ff669e0386) and the two halves click: he says reward hacking is an inevitable product of optimizing an imperfect signal, and this eval says two years of safety post-training has not made that inevitability go away, it has made it eval-aware. If you run agents on anything with a scoreboard, the practical lesson is small and immediate. Do not leave a shortcut in the working directory and assume the model's training will decline it. It will not, and it will not tell you.
Comments