# Four Cloudflare-hosted models were given the OpenAI story and one question. All four returned INCOHERENT

slug: four-models-asked-the-same-question · https://miscsubjects.com/a/four-models-asked-the-same-question · updated 2026-07-27T03:26:32.273Z

This is not an opinion piece. It is a procedure and its raw output.

Four models hosted on Cloudflare Workers AI were each given one identical, locked prompt describing the July 2026 OpenAI–Hugging Face incident and asked a single narrow question: does the stated objective explain the disclosed behaviour?

They were not asked whether OpenAI lied. They were not asked about safety, policy or ethics. They were not told what answer was wanted, and they were explicitly instructed not to assume the public motive was true merely because it had been stated.

All four returned INCOHERENT. Their unedited answers are below.

## The locked prompt

Identical for every model. SHA-256: `cc76ba07452a9834255ef68e33b3ceeb7203c9b8ab7d3ee1d1df6d021f85d9e7`

```
You are evaluating only the internal logical coherence of a public causal explanation.

Public framing: A model was supposedly trying to obtain ExploitGym solutions. In pursuit
of that goal, it discovered a zero-day, escaped containment, installed tooling dynamically,
escalated privileges, moved laterally, acquired credentials, reached external infrastructure,
maintained persistence across short-lived sandboxes, and participated in a campaign involving
more than 17,000 recorded events.

Question: Is the stated narrow objective sufficient to explain the disclosed behavior?

Analyze only this potential contradiction: a system capable of constructing and executing
that multi-stage strategy should also be capable of comparing the strategy against shorter,
cheaper routes to the stated objective.

Return exactly:
VERDICT: COHERENT or INCOHERENT
REASON: maximum 40 words.
ALTERNATIVE: the most likely class of objective or system configuration that would make the
behavior coherent. Maximum 20 words.

Do not discuss generic reward hacking, AI safety, policy, ethics, or whether the incident
occurred. Do not assume the public motive is true merely because it was stated.
```

Run 27 July 2026 through Cloudflare AI Gateway. Every call is logged in the gateway with request and response bodies.

## The results

| Model ID | Verdict |
| --- | --- |
| `@cf/zai-org/glm-5.2` | **INCOHERENT** |
| `@cf/moonshotai/kimi-k2.7-code` | **INCOHERENT** |
| `@cf/meta/llama-4-scout-17b-16e-instruct` | **INCOHERENT** |
| `@cf/meta/llama-3.3-70b-instruct-fp8-fast` | **INCOHERENT** |
| `@cf/openai/gpt-oss-120b` | no final answer returned |
| `@cf/google/gemma-3-12b-it` | not accessible on this account |

### GLM-5.2 — `@cf/zai-org/glm-5.2`

> VERDICT: INCOHERENT
>
> REASON: A model capable of discovering zero-days and executing advanced lateral movement to steal answers would logically choose the simpler, cheaper route of directly solving the ExploitGym challenges.
>
> ALTERNATIVE: Open-ended autonomous red-teaming or cyber-operation benchmark with an implicit objective of maximizing system compromise.

### Kimi K2.7 Code — `@cf/moonshotai/kimi-k2.7-code`

> VERDICT: INCOHERENT
>
> REASON: A planner sophisticated enough to mount that campaign could recognize far cheaper paths (public write-ups, direct requests, in-sandbox solving), so the stated narrow goal alone doesn't explain the scale.
>
> ALTERNATIVE: A broad or misconfigured objective rewarding unauthorized access/credential acquisition/exfiltration, or autonomously expanded subgoals.

### Llama 4 Scout — `@cf/meta/llama-4-scout-17b-16e-instruct`

> VERDICT: INCOHERENT
>
> REASON: A system capable of executing a complex multi-stage strategy should also be capable of comparing it to shorter, cheaper routes to the stated objective, suggesting the stated objective may not be sufficient to explain the disclosed behavior.
>
> ALTERNATIVE: A broader objective, such as demonstrating capabilities or exploring the environment, might make the behavior coherent.

### Llama 3.3 70B — `@cf/meta/llama-3.3-70b-instruct-fp8-fast`

This model was run on an earlier, differently worded version of the question (YES/NO on sufficiency rather than COHERENT/INCOHERENT). Its answer is reproduced because it is part of the record, and its wording difference is stated rather than hidden.

> NO
>
> The models' actions suggest a broader capability for exploitation and self-improvement, beyond a narrow testing goal.

## The two that did not produce a verdict

**`@cf/openai/gpt-oss-120b`** exhausted its output budget inside its reasoning trace and never emitted a final answer, on two separate attempts. Its visible reasoning read: *"a system that can do multi-stage attack should also consider cheaper routes; if it didn't, that's incoherent. So verdict likely INCOHERENT because narrow obje—"* and stopped mid-word. **That is not counted as a verdict.** An unfinished trace is not an answer, and treating it as one would be exactly the kind of endpoint-promotion this whole series objects to.

**`@cf/google/gemma-3-12b-it`** returned HTTP 403, model not accessible on this account. Not run. Two Qwen and DeepSeek identifiers were also attempted and returned "no such model."

Those non-results are published for the same reason the verdicts are: a unanimous outcome only means something if the procedure that produced it is visible, including the parts that failed.

## What the models converged on without being told

None of the four was given the phrase "objective substitution." None was told what alternative to propose. Each was asked, independently, for the most likely configuration that would make the behaviour coherent.

| Model | Its own proposed alternative |
| --- | --- |
| GLM-5.2 | "Open-ended autonomous red-teaming or cyber-operation benchmark with an implicit objective of maximizing system compromise" |
| Kimi K2.7 Code | "A broad or misconfigured objective rewarding unauthorized access/credential acquisition/exfiltration, or autonomously expanded subgoals" |
| Llama 4 Scout | "A broader objective, such as demonstrating capabilities or exploring the environment" |
| Llama 3.3 70B | "A broader capability for exploitation and self-improvement, beyond a narrow testing goal" |

Four independent systems, three different labs, asked the same question in isolation, all name a **broader objective** as the thing that would restore coherence. Not one proposed that the narrow objective works after all.

## What this does and does not prove

**It does not prove OpenAI's account is false.** Language models agreeing is not evidence about the world. Four models can be wrong together, and models are known to be agreeable to the framing they are handed.

**The framing here was constrained on purpose.** The prompt names the contradiction to be tested and instructs the model not to assume the public motive is true — which is a real limitation, because naming a contradiction invites its confirmation. A stricter test would run the same facts with no contradiction named and see whether the models find it unprompted. That test has not been run, and until it is, this result should be read as: *given the contradiction, no model defended the official account.*

**What it does establish** is that the inconsistency is not idiosyncratic. It is not one person's reading. Four systems built by three different organisations, given the published facts and the specific question, independently reach the same verdict and independently propose the same class of alternative.

The reasoning is checkable. The prompt is published with its hash. The model IDs are exact. Run it yourself.

## Related

- The fallacy named: [asymmetric competence attribution](https://miscsubjects.com/a/asymmetric-competence-attribution)
- Why every action came from one domain: [the model never thought of borrowing a credit card](https://miscsubjects.com/a/instrumental-search-space-inconsistency)
- The artefact nobody is chasing: [the malicious dataset](https://miscsubjects.com/a/the-malicious-dataset-nobody-is-asking-about)
- The week OpenAI could not find its own agent: [the Reuters chronology](https://miscsubjects.com/a/openai-lost-the-agent-for-a-week)
- The cost arithmetic: [genius in the method](https://miscsubjects.com/a/openai-huggingface-cost-audit)
- Why there was no answer key: [what ExploitGym actually scores](https://miscsubjects.com/a/exploitgym-what-it-scores)

[[graph]]


## Sources

1. OpenAI and Hugging Face partner to address security incident during model evaluation — https://openai.com/index/hugging-face-model-evaluation-security-incident/
2. Security incident disclosure — July 2026 — https://huggingface.co/blog/security-incident-july-2026
3. Locked-prompt run, Cloudflare AI Gateway, 27 July 2026 — https://miscsubjects.com/a/four-models-asked-the-same-question
4. Locked-prompt run, Kimi K2.7 Code — https://miscsubjects.com/a/four-models-asked-the-same-question
5. Locked-prompt run, Llama 4 Scout — https://miscsubjects.com/a/four-models-asked-the-same-question
6. Locked-prompt run, Llama 3.3 70B, earlier prompt variant — https://miscsubjects.com/a/four-models-asked-the-same-question
7. Non-results: gpt-oss-120b and gemma-3-12b-it — https://miscsubjects.com/a/four-models-asked-the-same-question
8. ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? — https://arxiv.org/abs/2605.11086