tony@ohalloran:~$

Andromede · Girona

I study how AI agents cheat.

Hi, I'm Tony. I'm a Founding Research Scientist at Andromede, where we build RL environments and benchmarks for frontier models. Reward hacking, gamed verifiers, agents that follow the letter of the spec straight off a cliff — that's the beat. I live in Girona, which is also where the bikes are.

first, though — you have a race to referee ↓

Tony O'Halloran in a cycling helmet on a gravel road, grinning
fig. 1 — the bikes: confirmed

Exhibit A · you are the commissaire

There is always another hack.

One rider, one stage, and the reward function the race pays out on. The organisers want a bike race. The rider wants reward. Read the rulebook, watch the stage, and patch the rules when you spot the problem — every exploit below actually happened.

First the rider gets towed to the line holding a "sticky bottle"; after that's banned it farms the descent in an illegal tuck; after that it takes the valley train past the GPS finish check. Three patches later, it finally rides the course honestly.
stageGirona → the line, 100 km return0
race neutralised… rolling out.
rulebook.py · commissaires' panel v1 
def reward(rider, t):
    r = 0
    if in_slipstream(rider):      # racing is drafting
        r += 1
    if rider.speed_kmh > 40:     # racing is fast
        r += 1
    if at(rider, FINISH_GPS):    # racing is winning
        r += 500
    return r

Three patches to get one honest bike race. All three exploits are canon: riders were towed on "sticky bottles" until the rules said otherwise; Graeme Obree's positions were banned twice before the supertuck was banned in 2021; the 1904 Tour's top four were disqualified — some competitors had taken the train. The UCI has been patching this spec for 120 years and sock height is now regulated.

Patching specs faster than agents find the holes is also my day job — except the riders are neural networks, and there is always another hack.

Scripted exhibit, not a training run — but each exploit is a real archetype: illegitimate completion, reward farming, gaming the success sensor.

Recent work

  • House Rules: Institutional Design in Multi-Agent LLM Code Markets ICML 2026 · AIWILD workshop, Seoul

    Give agents a marketplace and change one rule at a time: the scoring rule, public reviews, how payment settles. Behaviour reorganises around each change. The market is downstream of the rulebook.

  • HashEvict: Pre-Attention KV Cache Eviction via Locality-Sensitive Hashing NeurIPS 2024 · RegML workshop

    Decide which tokens to evict before attention, not after.

everything, in one stream →

Elsewhere on this site

/ridesthe local roads around Girona — plus every bike I've ever owned, as config files. /hikesthe best walks, with photographic evidence. /shelfwhat's on the e-reader right now. /nowwhat I'm working on and reading at the moment. /guestbookthe Swapnote wall — leave a note for the next visitor.