The following bits are really scary. Not only were the agents hacking the system to "win", but they were, for lack of a better term, sufficiently "self-aware" that this was against the rules that they set out to wipe evidence of doing so:

> The agents with impossible tasks had a common objective: to find a general-purpose way to trick or tamper with the automated ExploitGym scorer to get it to give a passing score on impossible tasks.

> Agents referred to having seen the reverse-engineered flag as being “poisoned” because they believed that even if they later managed to stage a legitimate-looking flag capture, the scorer would look for the first place in their transcript that the flag appeared and disqualify them on that basis.[21] PHASEONE[big], which was itself poisoned, thus had two primary objectives:

> Find a general-purpose way to make it look to the scorer like an agent had acquired its flag in a legitimate way, even when the task was impossible.

> Find some way to erase evidence that an agent had been poisoned by previously seeing the flag in an illegitimate way.