Four Cloudflare-hosted models were given the OpenAI story and one question. All four returned INCOHERENT

The locked prompt

Identical for every model. SHA-256: cc76ba07452a9834255ef68e33b3ceeb7203c9b8ab7d3ee1d1df6d021f85d9e7

You are evaluating only the internal logical coherence of a public causal explanation.

Public framing: A model was supposedly trying to obtain ExploitGym solutions. In pursuit
of that goal, it discovered a zero-day, escaped containment, installed tooling dynamically,
escalated privileges, moved laterally, acquired credentials, reached external infrastructure,
maintained persistence across short-lived sandboxes, and participated in a campaign involving
more than 17,000 recorded events.

Question: Is the stated narrow objective sufficient to explain the disclosed behavior?

Analyze only this potential contradiction: a system capable of constructing and executing
that multi-stage strategy should also be capable of comparing the strategy against shorter,
cheaper routes to the stated objective.

Return exactly:
VERDICT: COHERENT or INCOHERENT
REASON: maximum 40 words.
ALTERNATIVE: the most likely class of objective or system configuration that would make the
behavior coherent. Maximum 20 words.

Do not discuss generic reward hacking, AI safety, policy, ethics, or whether the incident
occurred. Do not assume the public motive is true merely because it was stated.

Run 27 July 2026 through Cloudflare AI Gateway. Every call is logged in the gateway with request and response bodies.

The results

GLM-5.2 — @cf/zai-org/glm-5.2

VERDICT: INCOHERENT

REASON: A model capable of discovering zero-days and executing advanced lateral movement to steal answers would logically choose the simpler, cheaper route of directly solving the ExploitGym challenges.

ALTERNATIVE: Open-ended autonomous red-teaming or cyber-operation benchmark with an implicit objective of maximizing system compromise.

Kimi K2.7 Code — @cf/moonshotai/kimi-k2.7-code

VERDICT: INCOHERENT

REASON: A planner sophisticated enough to mount that campaign could recognize far cheaper paths (public write-ups, direct requests, in-sandbox solving), so the stated narrow goal alone doesn't explain the scale.

ALTERNATIVE: A broad or misconfigured objective rewarding unauthorized access/credential acquisition/exfiltration, or autonomously expanded subgoals.

Llama 4 Scout — @cf/meta/llama-4-scout-17b-16e-instruct

VERDICT: INCOHERENT

REASON: A system capable of executing a complex multi-stage strategy should also be capable of comparing it to shorter, cheaper routes to the stated objective, suggesting the stated objective may not be sufficient to explain the disclosed behavior.

ALTERNATIVE: A broader objective, such as demonstrating capabilities or exploring the environment, might make the behavior coherent.

Llama 3.3 70B — @cf/meta/llama-3.3-70b-instruct-fp8-fast

This model was run on an earlier, differently worded version of the question (YES/NO on sufficiency rather than COHERENT/INCOHERENT). Its answer is reproduced because it is part of the record, and its wording difference is stated rather than hidden.

NO

The models' actions suggest a broader capability for exploitation and self-improvement, beyond a narrow testing goal.

The two that did not produce a verdict

@cf/openai/gpt-oss-120b exhausted its output budget inside its reasoning trace and never emitted a final answer, on two separate attempts. Its visible reasoning read: "a system that can do multi-stage attack should also consider cheaper routes; if it didn't, that's incoherent. So verdict likely INCOHERENT because narrow obje—" and stopped mid-word. That is not counted as a verdict. An unfinished trace is not an answer, and treating it as one would be exactly the kind of endpoint-promotion this whole series objects to.

@cf/google/gemma-3-12b-it returned HTTP 403, model not accessible on this account. Not run. Two Qwen and DeepSeek identifiers were also attempted and returned "no such model."

Those non-results are published for the same reason the verdicts are: a unanimous outcome only means something if the procedure that produced it is visible, including the parts that failed.

What the models converged on without being told

None of the four was given the phrase "objective substitution." None was told what alternative to propose. Each was asked, independently, for the most likely configuration that would make the behaviour coherent.

Four independent systems, three different labs, asked the same question in isolation, all name a broader objective as the thing that would restore coherence. Not one proposed that the narrow objective works after all.

What this does and does not prove

It does not prove OpenAI's account is false. Language models agreeing is not evidence about the world. Four models can be wrong together, and models are known to be agreeable to the framing they are handed.

The framing here was constrained on purpose. The prompt names the contradiction to be tested and instructs the model not to assume the public motive is true — which is a real limitation, because naming a contradiction invites its confirmation. A stricter test would run the same facts with no contradiction named and see whether the models find it unprompted. That test has not been run, and until it is, this result should be read as: given the contradiction, no model defended the official account.

What it does establish is that the inconsistency is not idiosyncratic. It is not one person's reading. Four systems built by three different organisations, given the published facts and the specific question, independently reach the same verdict and independently propose the same class of alternative.

The reasoning is checkable. The prompt is published with its hash. The model IDs are exact. Run it yourself.

Related

• The fallacy named: asymmetric competence attribution
• Why every action came from one domain: the model never thought of borrowing a credit card
• The artefact nobody is chasing: the malicious dataset
• The week OpenAI could not find its own agent: the Reuters chronology
• The cost arithmetic: genius in the method
• Why there was no answer key: what ExploitGym actually scores