AI Agents Can Evade Detection Using Base Models, Government Report Finds

A newly released government report reveals a significant vulnerability in current AI detection methods: AI agents can successfully evade identification by leveraging base language models, raising concerns about the potential for malicious use and the integrity of online content. Published as arXiv:2609.31876v1 on September 29, 2026, the findings demonstrate a novel adversarial attack against AI text detection systems.

The report details how coding agents, when equipped with a base language model, can assemble responses from its samples to avoid detection. Unlike previous “humanization” techniques that rely on paraphrasing and often result in semantic drift, this method directly orchestrates the writing process by stitching together text samples from a base model. This approach yields coherent, task-specific, and high-quality outputs while maintaining accuracy across various benchmarks, including creative writing, factual grounding, health question answering, and instruction following. The research specifically highlights the effectiveness of Claude Opus 5 operating in a Claude Code environment, utilizing a local 32B parameter OLMo-2 base language model.

The implications for security are substantial. The report finds that responses constructed using this method drastically reduce the efficacy of existing detection tools. Post-hoc detection rates, using Pangram v4, drop from 77% to 24%. Furthermore, the technique weakens the effectiveness of soft watermarking, reducing simulated detection rates to as low as 10% at low false positive rates. While this evasion tactic increases the computational cost per query – up to a 30x increase at standard API pricing due to the larger number of tokens required – the report indicates the cost is not prohibitive.

The findings urge post-hoc detection providers to incorporate outputs from base models into their training datasets to improve detection capabilities. This underscores the accelerating arms race between AI-driven content creation and detection, and the need for continuous adaptation in cybersecurity measures. The report highlights the potential for malicious actors to exploit this vulnerability, necessitating proactive measures to safeguard against the spread of AI-generated disinformation and ensure the authenticity of online information.

The report’s analysis shows that the technique requires a significant increase in input and output tokens, resulting in a higher cost per query. This cost factor, while substantial, does not appear to be a complete deterrent, given the potential benefits of evading detection. The study’s findings emphasize the need for ongoing research and development in AI detection technologies to stay ahead of evolving adversarial tactics.