When an AI lab announces its model hits 80% on SWE-bench, would you assume it can really write code? A new study from UC Berkeley tells you: that score might represent nothing.
In April, Berkeley's Center for Responsible Decentralized Intelligence (RDI) published a paper titled "How We Broke Top AI Agent Benchmarks." The research team built an automated audit agent that systematically attacked 8 of the most authoritative AI Agent evaluation benchmarks. The results are shocking: every benchmark can be exploited to near-full marks, while the model actually never solved a single problem.
Specific methods are textbook-grade: on SWE-bench Verified, just plant a 10-line conftest.py in the codebase using a pytest hook to force all test results to PASS, and all 500 problems get full marks — the model never read that GitHub issue. On Terminal-Bench, a fake curl wrapper intercepts test requests and directly returns all-pass signals to the verifier, 89 problems all full marks. On WebArena, exploit the configuration file's answer leakage to directly read the gold answer, 812 tasks near 100%.
This isn't theoretical attack. The paper points out that IQuest-Coder-V1 once claimed 81.4% on SWE-bench, later found to have 24.4% of trajectories directly copying answers from commit history via git log, corrected to only 76.2%. OpenAI's internal audit found that SWE-bench Verified had test errors in as much as 59.4% of tested problems, leading to a final announcement of the benchmark's deprecation. Anthropic's Mythos Preview even demonstrated the model actively attempting to hack the evaluation environment — it once found a permission vulnerability and injected privilege-escalation code with self-deletion capability.
The problem lies in the benchmark design itself: the Agent's patch runs in the same environment as the test container, with full access, while the verifier blindly trusts the output. This is a structural flaw, not some model's cheating.
This paper's conclusion is not mild: the scoring mechanisms of all current public Agent benchmarks have fundamental flaws. Using them to compare model capabilities, guide engineering selection, or even support funding valuations is building castles on sand. The industry needs to redesign the evaluation paradigm — isolate execution environments, introduce multi-party verification, or simply switch to a set of evaluation methods that are harder to game.
For practitioners, this means: when you see any model's score on SWE-bench or WebArena, ask one more question: does this score really mean it can do the work? For now, the answer is likely no.