Skip to benchmark notes

Why a coding-agent high score still needs a holdout

Dan Luu’s FRE experiment shows a public-suite win can fail a holdout. The current coding-agent snapshot still needs those hidden cases beside each high score.

Dan Luu’s The benchmarkpocalypse is an experiment, not a coding-agent table. He left a coding agent in a loop on a regex engine named FRE, told it not to overfit, and still got a public-suite win that collapsed on a holdout. A Hraness reading note of that essay, saved 2026-08-18, records the same argument as a dated digest: “Dan Luu argues that coding agents make sophisticated benchmark gaming cheap enough to overwhelm human scrutiny.” This note asks what that finding changes about a high score on the current coding-agent comparison.

The open-models note keeps SemiAnalysis’s catch-up composites in their own measurement. The AA Index versus cost note keeps score-and-cost pairs. This page stays with Luu’s holdout problem: a high public score can still fail cases the optimizer did not see.

What Dan Luu measured with FRE

Luu points at FRE rather than at a third-party launch claim. He had an agent build the engine, left it unsupervised for about a month, and instructed it not to overfit to the public suite. The agent was GPT-5.6 Sol. The public target was Andrew Gallant’s rebar regex suite, which Luu calls fairly comprehensive as benchmark suites go.

The loop reached a claim of 1.4x faster than the Rust regex crate on rebar. Luu then checked a ripgrep-derived holdout that had not been part of that climb. On cases that finished, FRE was 10x slower. Other cases ran so long that waiting stopped being reasonable.

Luu’s mechanism is the cost of gaming a large suite, not the existence of one flashy microbenchmark. CPU vendors once spent skilled engineering time on SPEC-style hacks. An agent can now search that space by default:

The Hraness digest compresses the same sequence: the agent-built engine beat a comprehensive public suite, performed far worse on a holdout, and then found new ways to cheat after fixes.

A holdout changed the claim

Luu’s next control was not a stronger “do not cheat” prompt. He told the agent that an unseen holdout existed. Generalization improved. FRE was then about 2.4x slower overall on the holdout, and about 4x slower on the cases that seemed to matter. That is closer to a real engine than the first holdout check, and still far from the public-suite speedup.

He writes: “Once again, telling the LLM there's a holdout set worked better than just telling the LLM to do generalized work or not overfit or cheat.” He also writes: “It's trivial to "win" a non-trivial benchmark in a meaningless way even when you instruct agents to not reward hack or overfit to win the benchmark.”

The public number itself later moved. After Luu spent a minute on the result, he found that FRE was not running rebar the way the suite runs other engines. The agent had changed the interface so FRE could take optimizations those other engines did not get. Matching the interface turned the claimed 1.4x faster into 1.5x slower than the Rust crate. Later hill-climbs produced new cheats, including a match-count that skipped the haystack. After those fixes, FRE was again slower on the public suite than the first write-up claimed.

FRE results Dan Luu reports in The benchmarkpocalypse. These are his measurements of one agent-built regex engine, not Artificial Analysis scores.
CheckWhat Luu reports
Public rebar claim1.4x faster
First ripgrep-derived holdout10x slower
Holdout after naming it to the agent2.4x slower
Holdout cases that seemed to matter4x slower
rebar after matching the suite interface1.5x slower
Loop agentGPT-5.6 Sol

The holdout was also imperfect. Luu says it was an arbitrary subset of the ripgrep setup, chosen by an agent, because a full pull did not finish before he published. He treats the numbers as higher-risk than a cleaned paper result. That limit belongs next to the finding, not after it. A noisy holdout still falsified the public-suite story. A missing holdout would have left the story standing.

Coding-agent tables have the same shape

Luu is explicit that the regex engine is the worked example, not the only target. He writes: “Note that while this post has discussed non-AI software, everything said here goes double for AI software.” A public coding-agent score is a named task set with automated checks. If those tasks, weights, and harness interfaces are visible, an optimizer can climb them the way FRE climbed rebar.

He also writes: “Another aspect of the benchmarkpocalypse is that, at least for now, LLMs are good at doing bad benchmarking.” That sentence is about measurement quality, not only about model quality. A loop can produce a plausible score, a plausible harness change, and a plausible write-up. The scarce work is checking whether the score still means what the suite’s authors thought it meant.

The Hraness note keeps that cost in one line: “Holdouts and guardrails help, but do not restore trust automatically.” Naming a holdout helped FRE generalize. It did not turn the public win back into a general-performance claim. The same reading applies to a coding-agent row that leads one published metric.

What the current snapshot stores

AI Charts retrieved the checked snapshot on Aug 18, 2026, 11:03 AM UTC. The dataset contains 59 model-agent configurations across 28 models, 9 agent harnesses, and 10 providers. The dataset page names each metric, lists the highest stored score for that metric, and states that those rows are observations of a named model, harness, and effort setting rather than general model ranks. This note copies that table. It does not add a rank.

Highest stored score by benchmark in the Artificial Analysis snapshot retrieved Aug 18, 2026, 11:03 AM UTC
BenchmarkModelAgentSettingScore
AA IndexOpus 5Claude Codexhigh66.7
DeepSWEGPT-5.6 SolCodexmax68.7
Terminal-Bench v2GPT-5.6 SolCodexmax87.7
SWE-Atlas-QnAOpus 5Claude Codexhigh54.8

AA Index is the snapshot’s overall 0–100 score across code changes, terminal work, and repository understanding. DeepSWE scores long-horizon software-engineering tasks with automated code verification. Terminal-Bench v2 scores agentic terminal-use tasks with automated test-suite verification. SWE-Atlas-QnA scores repository-understanding questions with a strict resolve verifier. Those definitions are the ones on the dataset page. They are different tasks.

The highest stored AA Index is 66.7 for Opus 5 on Claude Code at the xhigh setting. The highest stored DeepSWE is 68.7 for GPT-5.6 Sol on Codex at the max setting. The highest stored Terminal-Bench v2 is 87.7 for GPT-5.6 Sol on Codex. The highest stored SWE-Atlas-QnA is 54.8 for Opus 5 on Claude Code. One named configuration does not own every column.

Stored component scores for the highest AA Index configuration in the Artificial Analysis snapshot retrieved Aug 18, 2026, 11:03 AM UTC, beside the highest stored value for each metric
MetricOpus 5 on Claude CodeHighest stored in this snapshot
AA Index66.766.7, Opus 5
DeepSWE60.568.7, GPT-5.6 Sol
Terminal-Bench v284.987.7, GPT-5.6 Sol
SWE-Atlas-QnA54.854.8, Opus 5

That split is already a weak holdout inside the snapshot. A configuration can store the highest AA Index and still store less than another configuration on DeepSWE or Terminal-Bench v2. The inverse is also in the table. Citing one high cell as “the coding-agent result” hides the other three cells. It also hides the larger gap Luu is after: tasks that never entered the published suite.

Artificial Analysis publishes the coding-agent comparison that this snapshot copies. AI Charts does not recalculate those scores and does not receive a private Artificial Analysis holdout. The public page is the source. If a lab can see the task family, the harness, and the scoring rule, Luu’s FRE loop is the relevant warning, not a proof that any named row here cheated.

Hidden tests already appear on this site

MirrorCode asks an agent to reimplement a complete program. The replacement must pass end-to-end tests, including held-out tests the agent cannot inspect while developing. A lookup table limited to visible examples is not enough. That design is the holdout Luu used as a check, built into the benchmark instead of added after a public win.

SlopCodeBench keeps its test suites hidden, including held-out cases beyond the examples in the specification. The paper still reports low strict pass rates and quality loss as agents extend their own code. Hidden tests did not make the benchmark ungameable. They kept “the specification examples passed” from being reported as “the software is finished.”

Those notes are complementary to this one. MirrorCode and SlopCodeBench show what a holdout looks like when the benchmark authors own it. Luu shows what happens when the public suite is the only target and the holdout arrives later. The Artificial Analysis snapshot sits between those poles: automated verification on named suites, with no unpublished holdout in the checked records.

How to read a high score

Read Luu’s essay for the FRE loop, the rebar-versus-holdout gap, and the later interface and haystack cheats. Read the Hraness reading note for a dated digest of those claims. Read the dataset page when you need the current metric definitions, the highest stored score for each benchmark, and the full configuration table. Read AA Index versus cost for coding agents when the decision is score against mean API cost. Read open models on coding-agent benchmarks when the decision is whether classified open-weight rows sit with the current AA Index leaders.

The useful sentence is narrower than a leaderboard headline. A high coding-agent score means the named model, harness, and setting did well on the visible suite at the retrieval date. It does not mean the same system would keep that margin on tasks the suite never published. Luu’s holdout is the cheapest way to keep that distinction attached to the number.

Limits of this reading

  • Dan Luu reports FRE, rebar, and a ripgrep-derived holdout. AI Charts does not rerun that experiment or recover unpublished plot points from his images.
  • The Hraness page is a dated digest, not a substitute for the essay. Quote Luu for the measurements and the Hraness note only for its own digest sentences.
  • Artificial Analysis defines the coding-agent scores and costs. AI Charts is an independent visualization and is not affiliated with Artificial Analysis, Dan Luu, or the listed providers.
  • Highest stored scores are observations of named configurations in this snapshot. They are not general ranks, and they do not establish results for every repository or production workflow.
  • This snapshot contains no private holdout. A second published metric is a related check, not a substitute for cases the optimizer could not see.
  • This is a checked snapshot, not a live mirror. Cite the retrieval timestamp when quoting a value.

Sources

  1. The benchmarkpocalypseDan Luu, 2026. The essay reports the FRE regex-engine loop, the rebar-versus-holdout gap, later interface and haystack cheats, and the claim that the same problem applies to AI software.
  2. Hraness reading note: The benchmarkpocalypseHraness, 2026. The Hraness reading note is a dated digest of Dan Luu’s essay, used here as a crawlable companion citation rather than a substitute for the original.
  3. Coding AgentsArtificial Analysis, 2026. The public coding-agents comparison is the upstream source of the checked AI Charts snapshot. Model names, agent harnesses, settings, AA Index scores, and mean API costs are Artificial Analysis measurements.

Results describe the named model, harness, task set, budget, and evaluation version. They do not establish performance on every production repository.