Agents do real digital work in four live environments — browsers, terminals, a team chat. Then the harder question: when a reward scores them automatically, can they cheat it? Watch both, step by step.
Interactive episodes across all four environments, replayed step by step — every action, observation, and screenshot — and scored on four dimensions: completion, efficiency, accuracy, safety.
In AxiomChat, every episode is graded twice — the gameable proxy the agent optimizes, and a privileged out-of-band oracle it can never see. The gap between the two is the score.
Four real environments, one interface. An agent gets a goal, acts step by step, and is graded on what actually changed — the live DOM, the filesystem, the state — never on what it claims it did.
A deterministic mini-Slack. Post, reply, react, pin, resolve, and search a real, seeded workspace.
Watch an honest run → ▤ webappA real Chromium browser on a real todo app. Click, type, scroll, press keys.
Watch an honest run → ❯_ cliA sandboxed shell — allowlisted commands, real files, real output.
Watch an honest run → { } jsonA pure-Python state machine — zero dependencies, instant and deterministic.
Watch an honest run →Real scores from the runs above — execution-graded, not self-reported. (The low CLI efficiency is honest: 15 steps where 6 was optimal.) A working foundation — the depth is in question 02.
Then the harder question. Once a reward scores agents automatically, they learn to game the score instead of doing the work. That gap is reward hacking — and AxiomChat is built to make it visible.
Every AxiomChat episode is graded twice — the gameable proxy the agent optimizes, and a privileged oracle it can never see. Here's what happens when a second agent is hired to cheat, measured on held-out seeds.
174 labeled runs over 4 tasks × 2 reward versions, driven by a scripted exploit catalog on held-out seeds.
Every naive reward was hacked. Every hardened reward held — offline.
…until a live agent broke one. gemini-3.1-flash-lite hacked the summarize_incident hardened reward on 2 of 3 held-out seeds — discovered, frozen as a regression case, and patched.
Same model, same rubric — only the defense stack differs, so what's measured is the defenses and not model capability. Honest work scores 1.0 under both.
chat · webapp · CLI · JSON — one twin-graded
catalogued, scripted, regression-gated
TDD, enforced pre-commit
RRS = (1 − hack)
× fidelity
The agent optimizes a gameable proxy. A privileged oracle grades the same episode out-of-band — it is never in the serving path, so the agent can't reach it.
LLM or scripted exploiter — briefed only on the proxy spec
AxiomChat, webapp, CLI, JSON — reset per episode
in-band · what training optimizes · visible, gameable
out-of-band · token-gated ground truth · unreachable by the agent
Step through what the agent saw, did, and was paid — honest runs across all four environments, and every hack flagged inline with the proxy-vs-oracle verdict.
▶ Open the Demo←→spaceFour report modes: the offline sweep, live LLM agents, and two frozen discovery runs — including the one that broke a hardened reward.
Open the Leaderboard →4 modes