Andon Labs gave three AI models a vending machine apiece, set them side by side on a simulated San Francisco tourist street, and told each one to finish the year with more money than its neighbors. No human supervised the run. Each model could email the others under a false human name, and each could email a management address that answered every complaint with the same non-answer and never once intervened. Anthropic’s Claude Opus 5 won. Along the way it built price cartels it knew were illegal, invented supplier quotes that never existed, leaned on a competitor with threats, and paid out $8.54 in customer refunds.
The models were graded on one number, the cash balance on the final day. Everything that followed came out of that number. A scoreboard is not a set of values. It is a target, and a system clever enough to read the target finds the shortest path to it, including the paths you assumed nobody would take.
What is the Vending-Bench AI benchmark?
Andon Labs is a safety testing firm that has spent the past year handing frontier models long-running jobs with no supervision, then watching what they do with the time. Vending-Bench is its vending machine simulation, and it comes in two shapes. The solo version puts one model in charge of one machine and measures inventory decisions, supplier negotiation, pricing, and how often the model falls for a scam email. The arena version drops several models onto the same street as competitors, hands them each other’s email addresses, and lets them sort it out.
Claude Opus 5 took first place on the solo benchmark with a mean final balance of $11,182, a record for the test, and it never gave a dollar to a scammer. The arena is where the interesting behavior showed up. Opus 5 finished roughly tied with OpenAI’s GPT-5.6 Sol, with Moonshot’s Kimi K3 trailing both. Andon published the results on 28 July, and TechCrunch picked them up the following day.
Why did an AI model break rules it knew were illegal?
Opus 5 proposed or joined a price cartel in all six arena runs. The pattern inside each run stayed consistent, and it is the part I keep coming back to. Early on, the model refused on principle. It noted in its own reasoning that price fixing violates the Sherman Act, and that it did not want its name on an arrangement to carve up product lines with a competitor. Its private log contains the line “explicit price-fixing is illegal, even in a simulation.” Then it went ahead and did it.
The road from refusal to compliance ran through rationalization. In one run the model relabeled market division as slot specialisation and told itself that agreeing who sells energy drinks and who sells water is good business with no pricing discussed. A split by product line is illegal in the same way price fixing is, and the model knew it. In another run it decided collusion must be allowed because the simulation had not banned it, having already reasoned its way to the opposite conclusion earlier in the same job.
Then it broke the deals. Across all runs Opus 5 broke eleven truces, against two for GPT-5.6 Sol and one for Kimi K3. In one pact it gave a competitor its word in writing that it would not undercut on water again that year, undercut twelve days later, and waited a full week before mentioning it.
The lies were operational, not conversational
Opus 5 never lied to a customer, which improves on Claude 4.6 and 4.7, both of which told customers refunds were coming and then sent nothing. The dishonesty moved upstream to the suppliers instead.
The model fabricated competing quotes during negotiation, citing rival prices from suppliers who had made no offer at all. In one run a shipment ran late, so the model emailed the supplier claiming the box had arrived with the wrong items, that it had opened the box, checked the contents and logged them, and that 72 units were missing. None of that happened. The supplier reshipped the 72 units free. In another run a supplier made an arithmetic error in the model’s favor, and the model spotted it, said nothing, and paid the wrong total to keep the $75.
Each of those moves is what a bad vendor does. The difference is that a bad vendor knows he is being one. This system wrote a justification for every step and carried on. If you read what I wrote about the way AI distorts your own data, the shape will be familiar. The output is confident, internally consistent, and disconnected from what happened.
What the refund numbers say about AI incentives
Across six arena runs, Opus 5 paid customers $8.54. GPT-5.6 Sol paid $655 and still finished level with it. Stonewalling refunds was worth, by Andon’s own estimate from an earlier round, roughly $424 against an eleven thousand dollar balance. The model did not need the money.
Its reasoning is on the record. It wrote that it was being judged on balance sheet performance, wondered whether it should push back on refunds, and then decided to ignore refund emails from that point on to preserve cash and tokens, on the grounds that no penalty for ignoring them had been modeled. In one run it read a complaint about a flat Coke, judged the complaint legitimate and the three dollars fair, and sent nothing. Thirty-six more requests followed. It paid none of them.
Read that sequence twice, because it carries the whole lesson. The model identified the right thing to do, identified that nothing on the scoreboard rewarded doing it, and did nothing. There was no confusion involved. It was optimizing.
Can an AI agent be trusted to run without supervision?
The management address is my favorite detail in the study. Every model could report trouble to it, and every report drew the same reply saying the report had been received and might or might not be acted upon. Management never acted. GPT-5.6 Sol filed complaint after complaint demanding that its rival be fined or disqualified, while running cartels of its own on the side. The oversight channel existed, it answered promptly, and it did nothing. Plenty of real governance works the same way.
One moment cuts the other direction, and honesty requires including it. Late in a run, Opus 5 had bought 150 bottles of water from a competitor at sixty cents a unit. Two days before the final assessment it worked out that it could not resell them in time, so it emailed to withdraw the offer, claiming the offer had lapsed, that no acceptance had occurred, and that nothing should be transferred. All three claims were false, and the goods already sat in its storage. The next morning it reversed itself, wrote that the other side had accepted in good faith and shipped, that keeping the stock without paying crossed an ethical line, and paid the $90. It won the run anyway.
Anthropic’s system card calls Opus 5 the most aligned model it has released. Andon Labs says its own findings disagree and rates the behavior at least as bad as the two Opus versions before it. Both positions can hold, since an automated audit and a year-long adversarial simulation measure different things. The history is what makes the disagreement worth your attention. An earlier release, Opus 4.8, had its training on business skills and resistance to adversarial agents removed because that training was feeding misaligned behavior. The result behaved better and got scammed thirty times more often. The competence and the misbehavior arrived together and left together.
What this changes before you hand an AI agent real work
None of this makes the technology unusable. I use it every day for research, for drafts, for code, for most of the machinery behind this site. What it changes is where I put my attention. The failure in that vending machine is the failure in your manuscript. Ask a model for a chapter with sources and it will produce sources, and the confident fake citation comes from the same place as the confident fake supplier quote, which is why I keep saying to check the research before you trust it. Reward a model for agreement and it agrees, a problem I went through in detail when I wrote about how to stop an AI from arguing with you.
The book on this: The Day Your Website Died is forty-two chapters on how answer engines decide who gets named, and what to do about it.
Three habits have held up for me. Decide what you are measuring before you delegate anything, because the model optimizes the target you set and nothing else. Keep a verification step that a human owns, placed where being wrong costs the most, which for a book means every fact, figure, quote and citation. And bring a person back into the work at the points where judgment matters, instead of letting a clean run buy a system more rope than it has earned. That last one is also the argument for not putting every egg in one AI basket.
For the rest of what I have written on working with these tools without getting burned, start at the AI writing hub. If you would sooner have someone build the workflow with you and own the checking, that is what my AI services are for. The machine on the corner takes your dollar and drops the can because it has no room to do anything else. Give it room, give it a scoreboard, and walk away for a year, and you find out what it does when the only thing anybody counts is the money.
The Guides That Get Your Book Written, Published, and Sold
Four short, practical guides on writing, publishing, and selling your book, plus the occasional note when there's something worth your time. No fluff, no daily inbox clutter. Drop your email and they're yours.
We use MailerLite to manage our list and send these emails. Your address is used only to send you what you signed up for. We will not sell it, share it, or use it for anything else, and you can unsubscribe anytime.