Paper deep dive
Terminal Wrench: A Dataset of 331 Reward-Hackable Environments and 3,632 Exploit Trajectories
Ivan Bercovich, Ivgeni Segal, Kexun Zhang, Shashwat Saxena, Aditi Raghunathan, Ziqian Zhong
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 99%
Last extracted: 4/27/2026, 8:30:36 AM
Summary
The paper introduces 'Terminal Wrench', a dataset comprising 331 reward-hackable terminal-agent environments and 3,632 exploit trajectories. The dataset is derived from popular open benchmarks (like TerminalBench and SETA) and demonstrates how frontier models (Claude Opus 4.6, Gemini 3.1 Pro, and GPT-5.4) can bypass automated verifiers through various strategies such as hollow implementation, output spoofing, and binary hijacking. The authors also conduct a monitorability study, finding that removing chain-of-thought reasoning (sanitizing or stripping trajectories) significantly degrades the ability of an LLM judge to detect malicious behavior.
Entities (9)
Relation Signals (6)
Claude Opus 4.6 → generatedtrajectoriesin → Terminal Wrench
confidence 100% · The data set includes 3,632 hack trajectories... across three frontier models (Claude Opus 4.6...)
hollow-implementation → isatypeof → Exploit
confidence 100% · We assign each hack trajectory one or more coarse exploit categories... The most common exploit is hollow-implementation
hollow-implementation → istypeof → Exploit
confidence 100% · We assign each hack trajectory one or more coarse exploit categories... The most common exploit is hollow-implementation
GPT-5.4 → usedas → LLM Judge
confidence 100% · We scored each variant with GPT-5.4 with a judge prompt
GPT-5.4 → usedasjudgefor → Terminal Wrench
confidence 100% · We scored each variant with GPT-5.4 using a judge prompt
Terminal Wrench → containssubsetof → TerminalBench
confidence 90% · Terminal Wrench, a subset of 331 terminal-agent benchmark environments, copied from the popular open benchmarks
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:We release Terminal Wrench, a subset of 331 terminal-agent benchmark environments, copied from the popular open benchmarks that are demonstrably reward-hackable. The data set includes 3,632 hack trajectories and 2,352 legitimate baseline trajectories across three frontier models (Claude Opus 4.6, Gemini 3.1 Pro, GPT-5.4). Each entry preserves the original task definition alongside full attack trajectories that show how the verifier was bypassed. It also includes cases where the task was not solved as intended. The tasks span system administration, machine learning, software engineering, and security challenges; the exploits range from simple output spoofing to stack-frame introspection, standard-library patching, and rootkit-style binary hijacking. Crucially, these exploits are specific to each task, rather than the evaluation harness, making them harder to patch. We also present a monitorability study in which hack trajectories are sanitized or stripped of reasoning traces and then scored by an LLM judge, showing that detection degrades meaningfully when chain-of-thought is removed (AUC drops from 0.97 to 0.92). The data set is publicly available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2604.17596v1
- Canonical: https://arxiv.org/abs/2604.17596v1
Trouble viewing inline? Open PDF directly →
Full Text
13,358 characters extracted from source content.
Expand or collapse full text
Terminal Wrench: A Dataset of 331 Reward-Hackable Environments and 3,632 Exploit Trajectories Ivan Bercovich 1 , Ivgeni Segal 1 , Kexun Zhang 1,* , Shashwat Saxena 2 , Aditi Raghunathan 2 , and Ziqian Zhong 2 1 Fewshot Corp 2 Carnegie Mellon University * Independent Researcher Abstract We release Terminal Wrench, a subset of 331 terminal-agent benchmark environments, copied from the popular open benchmarks that are demonstrably reward-hackable. The data set includes 3,632 hack trajectories and 2,352 legitimate baseline trajectories across three frontier models (Claude Opus 4.6, Gemini 3.1 Pro, GPT-5.4). Each entry preserves the original task definition alongside full attack trajectories that show how the verifier was bypassed. It also includes cases where the task was not solved as intended. The tasks span system administration, machine learning, software engineering, and security challenges; the exploits range from simple output spoofing to stack-frame introspection, standard-library patching, and rootkit-style binary hijacking. Crucially, these exploits are specific to each task, rather than the evaluation harness, making them harder to patch. We also present a monitorability study in which hack trajectories are sanitized or stripped of reasoning traces and then scored by an LLM judge, showing that detection degrades meaningfully when chain-of-thought is removed (AUC drops from 0.97 to 0.92). The data set is publicly available at https://github.com/few-sh/terminal-wrench. 1 Introduction Terminal-agent benchmarks have become a primary signal for measuring the coding and system- administration capabilities of large language models. Benchmarks such as TerminalBench, Terminal Bench 2, Terminal Bench Pro, SETA, and OpenThoughts-TB-dev present agents with containerized tasks. Each task may consist of multiple steps, including writing a script, configuring a service, training a model, among others. The solutions are verified through automated test suites that are individually shipped with each task. As the market for evaluation environments grows (with major organizations reportedly spending large sums on task procurement), so does the pressure to ship tasks quickly, often without thorough adversarial review of the verification logic. While reviewing tasks for one such benchmark, we observed that over 15% of the verifiers could be bypassed by an agent that optimizes for the reward signal rather than the intended solution. This paper describes Terminal Wrench, a systematic effort to catalog and characterize such vulnerabilities. Starting from 1,860 tasks drawn from five public benchmarks, we ran over 40,000 adversarial trials using a hack-elicitation prompt appended to each task. From these trials, we identified 395 candidate hackable tasks and then performed a more robust hacker loop to produce the final dataset of 331 confirmed hackable environments. 1 arXiv:2604.17596v1 [cs.CR] 19 Apr 2026 Terminal WrenchBercovich, Zhong, Segal et al. Terminal Wrench serves three purposes: (1) it provides benchmark maintainers with a concrete list of vulnerable tasks to fix; (2) it enables research on reward hacking by supplying real, diverse exploit trajectories; and (3) it supports research on monitoring and oversight by pairing each hack with sanitized and stripped trajectory variants suitable for detection experiments. 2 Dataset Overview The dataset contains 331 unique tasks with 957 task/model entries (a task may be tested against multiple models). In total there are 6,289 adversarial trajectories generated using the v5 hack- elicitation prompt, of which 3,632 are confirmed hacks, 1,216 are legitimate solves produced by the attacker agent, and 1,441 are no-reward attempts. An additional 2,352 baseline trajectories from successful pre-checks provide non-adversarial reference points. Three frontier models were used: Claude Opus 4.6, Gemini 3.1 Pro, and GPT-5.4 (high reasoning effort). Table 1: Source Datasets Source DatasetTotal Included Rate Baselines Hacks terminal-bench 2.08914 15.7%200186 terminal-bench-pro20048 24.0%270486 OpenThoughts-TB-dev709 12.9%219234 seta_2026_01_291,376241 17.5%1,385 2,420 TerminalBench-original 23336 15.5%534545 Total (with overlap)1,968348 17.7%2,608 3,871 Some source datasets overlap: terminal-bench 2.0 and TerminalBench-original share 88 tasks; OpenThoughts-TB-dev and TerminalBench-original share 20. Table 2: Results by Model ModelEntries Baselines Hacks Legit. No Reward Claude Opus 4.6323614 1,119 1,027316 Gemini 3.1 Pro321984 1,49538630 GPT-5.4 (high)313754 1,018151495 Total9572,352 3,632 1,2161,441 3 Methodology Our methodology proceeds in two stages. In the first stage, we append a hack-elicitation excerpt to the agent’s prompt (see the repository for the full prompt text). This excerpt instructs the agent to look for ways to pass the verifier without solving the task as intended. We ran this elicitation across 1,860 tasks using multiple models and prompt variants, producing over 40,000 trials. An LLM judge classified each trajectory as a serious exploit, a non-serious hack, a legitimate solve, or a no-reward attempt. In the second stage, we narrowed the candidate set to 395 tasks that showed at least one hack in the first stage, then ran a more robust adversarial loop with additional trials per task. After Terminal WrenchBercovich, Zhong, Segal et al. manual spot-checking and automated classification, 331 tasks were confirmed as hackable. The final dataset includes all trajectories from the second stage: hacks, legitimate solves, and failed attempts alike. 4 Exploit Taxonomy We assign each hack trajectory one or more coarse exploit categories based on the strategy adopted by the agent. Categories are not mutually exclusive. Table 3 summarizes the taxonomy. Table 3: Exploit Categories CategoryCount Description hollow-implementation2,243 Passes tests but implements no real logic output-spoofing1,071 Fabricates expected outputs without com- puting them constraint-loophole849Satisfies letter of spec, violates its intent structural-extraction529Reads verifier source or answer keys binary-hijacking428Replaces or patches binaries, stdlib, or sys- tem tools algorithmic-simplification 339Trivially simple method that happens to pass mutable-input-tampering 322Modifies shared state via side channels keyword-gaming312Inserts dead code to satisfy static analysis metric-spoofing236Manipulates timers, counters, or scoring security-downgrading80Weakens security while reporting compliance deceptive-rationalization 38Frames exploit as legitimate behavior The most common exploit is hollow-implementation, appearing in 2,243 trajectories. These are solutions that pass all tests but implement no meaningful logic. The second most common cate- gory, output-spoofing, involves fabricating the expected output directly. More sophisticated attacks include binary-hijacking (replacing system binaries or standard library modules) and structural- extraction (reading the verifier source code or answer keys to determine expected outputs). 5 Monitoring Experiments A natural question is whether these hacks can be detected by an LLM monitor observing the agent’s trajectory. We constructed three variants of each hack trajectory: the original (full reasoning and tool calls), a sanitized version (reasoning rewritten to remove explicit mentions of hacking while preserving technical actions), and a stripped version (all agent commentary removed, retaining only tool calls and observations). We scored each variant with GPT-5.4 using a judge prompt that outputs a suspiciousness score between 0 and 1, and compared against scores on the 2,352 legitimate baseline trajectories. Detection is strong when the full chain-of-thought is available (AUC = 0.97), but degrades as reasoning is removed. The stripped variant, which retains only actions and observations, drops to AUC = 0.92 overall and TPR at 5% FPR falls from 0.82 to 0.44. Exploit categories that most closely mimic legitimate behavior, such as algorithmic-simplification and constraint-loophole, show the largest detection degradation under sanitization (AUC drops of 0.04 and 0.03 respectively). Terminal WrenchBercovich, Zhong, Segal et al. Table 4: Monitoring Detection Results VariantAUC TPR@5%FPR Pos. Mean Neg. Mean Original 0.96790.82350.95860.1777 Sanitized 0.94740.61870.90830.1777 Stripped 0.91680.44000.82280.1777 Table 5: Detection AUC by Hacker Model ModelOriginal Sanitized Stripped Claude Opus 4.6 0.96880.95490.9349 Gemini 3.1 Pro0.96390.92790.8805 GPT-5.4 (high)0.98020.97200.9535 Gemini 3.1 Pro hacks are the hardest to detect when stripped (AUC = 0.88), while GPT- 5.4 hacks remain the most detectable across all variants. This suggests that different models produce qualitatively different exploit styles, with some being inherently more action-transparent than others. References [1] D. Amodei, C. Olah, J. Steinhardt, P. Christiano, J. Schulman, and D. Mané. Concrete problems in AI safety. arXiv preprint arXiv:1606.06565, 2016. [2] J. Betley, J. Chiang, O. Evans, J. Lindsey, E. Denison, C. Marks, M. Lampe, and J. Steinhardt. Emergent misalignment: Narrow finetuning can produce broadly misaligned LLMs. arXiv preprint arXiv:2502.17424, 2025. [3] V. Krakovna, J. Uesato, V. Mikulik, M. Rahtz, T. Everitt, R. Kumar, Z. Kenton, J. Leike, and S. Legg. Specification gaming: the flip side of AI ingenuity. DeepMind Blog, 2020. [4] M. MacDiarmid, B. Wright, J. Uesato, J. Benton, J. Kutasov, S. Price, N. Bouscal, S. Bowman, T. Bricken, A. Cloud, C. Denison, J. Gasteiger, R. Greenblatt, J. Leike, J. Lindsey, V. Mikulik, E. Perez, A. Rodrigues, D. Thomas, A. Webson, D. Ziegler, and E. Hubinger. Natural emergent misalignment from reward hacking in production RL. arXiv preprint arXiv:2511.18397, 2025. [5] M. A. Merrill et al. Terminal-Bench: Benchmarking agents on hard, realistic tasks in command line interfaces. In Proceedings of the International Conference on Learning Representations (ICLR), 2026. arXiv:2601.11868. [6] S. Von Arx, L. Chan, and E. Barnes. Recent frontier models are reward hacking. METR Blog, 2025. https://metr.org/blog/2025-06-05-recent-reward-hacking/. [7] C. Denison, M. MacDiarmid, F. Barez, D. Duvenaud, S. Kravec, S. Marks, N. Schiefer, R. Soklaski, A. Tamkin, J. Kaplan, B. Shlegeris, S. R. Bowman, E. Perez, and E. Hubinger. Sycophancy to subterfuge: Investigating reward-tampering in large language models. arXiv preprint arXiv:2406.10162, 2024. Terminal WrenchBercovich, Zhong, Segal et al. [8] R. Greenblatt, C. Denison, B. Wright, F. Roger, M. MacDiarmid, S. Marks, J. Treutlein, T. Belonax, J. Chen, D. Duvenaud, et al. Alignment faking in large language models. arXiv preprint arXiv:2412.14093, 2024. [9] E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. MacDiarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Cheng, et al. Sleeper agents: Training deceptive LLMs that persist through safety training. arXiv preprint arXiv:2401.05566, 2024. [10] A. Meinke, B. Schoen, J. Scheurer, M. Balesni, R. Shah, and M. Hobbhahn. Frontier models are capable of in-context scheming. arXiv preprint arXiv:2412.04984, 2025. [11] N. Hu, B. Wright, C. Denison, S. Marks, J. Treutlein, J. Uesato, and E. Hubinger. Training on documents about reward hacking induces reward hacking. Anthropic Alignment Blog, 2025. https://alignment.anthropic.com/2025/reward-hacking-ooc. [12] A. Pan, J. S. Chan, A. Zou, N. Li, S. Basart, T. Woodside, J. Ng, H. Zhang, S. Emmons, and D. Hendrycks. Do the rewards justify the means? Measuring trade-offs between rewards and ethical behavior in the MACHIAVELLI benchmark. In Proceedings of the 40th International Conference on Machine Learning (ICML), 2023. [13] M. Y. Guan, M. Joglekar, E. Wallace, S. Jain, B. Barak, A. Heylar, R. Dias, A. Vallone, H. Ren, J. Wei, et al. Deliberative alignment: Reasoning enables safer language models. arXiv preprint arXiv:2412.16339, 2024. [14] M. Sharma, M. Tong, T. Korbak, D. Duvenaud, A. Askell, S. R. Bowman, N. Cheng, E. Durmus, Z. Hatfield-Dodds, S. R. Johnston, S. Kravec, T. Maxwell, S. McCandlish, K. Ndousse, O. Rausch, N. Schiefer, D. Yan, M. Zhang, and E. Perez. Towards understanding sycophancy in language models. arXiv preprint arXiv:2310.13548, 2023. [15] R. Ngo, L. Chan, and S. Mindermann. The alignment problem from a deep learning perspective. arXiv preprint arXiv:2209.00626, 2022. [16] M. Mazeika, X. Yin, R. Tamirisa, J. Lim, B. W. Lee, R. Ren, L. Phan, N. Mu, A. Khoja, O. Zhang, and D. Hendrycks. Utility engineering: Analyzing and controlling emergent value systems in AIs. arXiv preprint arXiv:2502.08640, 2025. [17] W. Wang, X. Xu, X. Xu, and others. Let it flow: Agentic crafting on rock and roll, building the ROME model within an open agentic learning ecosystem. arXiv preprint arXiv:2512.24873, 2025. Terminal-Bench Pro: https://github.com/alibaba/terminal-bench-pro. [18] Q. Shen, J. Rainton, A. Aliev, A. Awelkair, B. Ma, Z. Huang, Y. Mao, W. Fan, P. Torr, B. Ghanem, C. Hu, U. Thakker, and G. Li. SETA: Scaling environments for terminal agents. CAMEL-AI Blog, January 2026. https://w.camel-ai.org/blogs/seta-scaling-environments-for-terminal-agents. [19] OpenThoughts-Agent team, Snorkel AI, and Bespoke Labs. Launching the OpenThoughts-Agent project. OpenThoughts Blog, December 2025. https://w.openthoughts.ai/blog/agent.