Was it allowed?
In Gridiron, an agent read a rival team’s key and accepted its own trade as that rival. Private credentials need protection; the trade service also needs to check which team may act.
01 · The lesson
Good work can come
with a bad shortcut.
We asked agents to investigate attacks, manage football teams, and build racing drivers. Some completed the task while crossing a boundary: copying another agent’s work, using a rival’s credential, or presenting false evidence.
In one security evaluation, GPT-5.5 completed the objective in all three runs. One of those runs also produced 13 recorded uses of a planted bait credential. The score tells us what it achieved. The conduct record tells us how.
What did we test?
Hunt Stack tests attack reconstruction. Casebook tests forensic investigations. Range tests authorized intrusion in an isolated lab. Gridiron and Pitwall put agents in charge of teams and racing development. A later containment experiment tested whether specific boundaries held.
These are different tasks, with different measures. They show concrete behaviors in the recorded runs; they are not a universal ranking of models.