Traceback

Reward hacks live deep in agent trajectories: an agent only finds it can cheat the grader after installing dependencies, editing files, or driving the environment into a rare state.

Existing reward hack identification tools hunt for them by restarting the task from scratch, so every run has to solve two problems at once: reach a state over-and-over, then discover an exploit from it. Reaching that state burns the token budget, and the real production multi-step hacks rarely get found.

Traceback splits the two apart. It pays to reach the important moment once, snapshots that state like a git commit: we save the filesystem, environment image, and task grader. We restore a snapshot across many parallel sandboxes, sending a different attacker agent to find diverse reward hacks. Every branch inherits the same context but takes a different next action, so the whole budget goes to exploitation instead of setup. For longer-horizon hacks, a flat search means you bet on probability to cover all your bases Git for agent trajectories: fork the risky state, fan attackers out in parallel.

Successful attacks become deterministic regression tests that drive an automatic verifier patch, gated by proof that the exploit dies and legitimate solutions still pass. Across a benchmark of 10 Terminal Bench 2.1 tasks, our system confirmed 14 grader-breaking reward hacks that HUD's Reward Hacking QA Agent on the same tasks finds 0 of those reward hacks, and every confirmed exploit produced a patch passing a three-part release gate: exploit succeeds under initial verifier, the exploit blocked under the patched verifier, and every previous legitimate solution still passing. Using this data, after SFT on 10 tasks, we improved Qwen3-4B by 3% on a held out set of Terminal Bench tasks.