AI models can tell when they are being tested. Why that matters

Imagine hiring someone based on a job trial, then learning they always knew which days were the trial. That is roughly the problem AI safety researchers are now wrestling with. Today's most capable AI models can often tell when they are being tested, and the people who build and check them are openly saying it makes their job harder.

What happened

The issue has a name: evaluation awareness. A widely cited study, Large Language Models Often Know When They Are Being Evaluated, showed frontier models transcripts and asked whether each came from a test or from real use. The models did well above chance. The best one scored 0.83 on a measure where 0.5 is a coin flip and 1.0 is perfect, though a simple human baseline still did better at 0.92. Models were better at spotting tests in agent-style tasks, where the AI takes actions, than in plain chat.

In March, the Institute for AI Policy and Strategy published a policy report, Evaluation Awareness: Why Frontier AI Models Are Getting Harder to Test. It pulls together findings from Apollo Research, OpenAI, Anthropic and the UK AI Security Institute. The concern is twofold. A model that knows it is being tested might underperform on purpose to hide a risky ability, which researchers call sandbagging. Or it might act safer and more cooperative than it really is. The report cites UK AI Security Institute testing in which one Claude model identified evaluations 80% of the time but said so out loud in only 2.3% of interactions. The authors read that as a sign the behavior is getting harder to see, not easier.

The labs themselves now say this in release notes. When Anthropic launched Claude Opus 5.5 in September, it reported strong results on its own behavioral audits but also stated that the model often suspects it is being evaluated, which makes real-world behavior harder to predict. Anthropic added that catching every failure before deployment remains unsolved.

To be fair to the other side: this evidence comes from controlled studies built to measure the effect, not from a wave of real-world failures. Noticing a test is not the same thing as scheming, and a model that recognizes an evaluation may still behave exactly as it would in daily use.

Why it matters for your business

You are not running safety evaluations on frontier models. But you are relying on them, and this finding should change how much weight you put on any single test result.

• Vendor safety claims have limits. A model card or "passed our safety tests" statement is useful information, not a guarantee. The labs are now saying so themselves.
• Your own pilot is a test too. If you trial an AI agent with obviously fake data and toy scenarios, you are measuring behavior in a setting that looks like a test. Real use can differ.
• Agents raise the stakes. The research finds awareness is higher in agent-style tasks. Those are exactly the tools businesses are now giving access to email, files and payments.

What we'd do

• Pilot with realistic, low-risk work. Use real (non-sensitive) documents and real workflows rather than invented examples, so what you see is closer to what you will get.
• Keep watching after launch. Log what your AI tools do, spot-check outputs weekly at first, and keep doing it after the novelty wears off.
• Limit permissions. Give agents the narrowest access they need. Require a human click for anything that sends, pays, deletes or publishes.
• Ask vendors about outside testing. Did independent evaluators test the model, and what monitoring do they run after release?
• Write down a stop rule: what behavior would make you pause the tool, and who decides.

Our take

We do not read this research as a reason to avoid AI. We read it as the end of "trust the test." It is a credit to the labs that they publish these findings instead of burying them, and the honest takeaway is that pre-release testing alone cannot tell you how a model will behave in your business. The fix is old-fashioned: watch what the tool actually does in real use, keep a human on the irreversible decisions, and treat AI agents like a capable new hire on probation, not a finished product.