By 
AI systems are increasingly judged not only by what they can do, but by how reliably their performance can be measured, traced, and governed.
In this interview, Abhishek Saxena, Head of Strategy and Growth at Sentient, discusses what happens when AI agents optimise for a score rather than the task, and why reward hacking often exposes weaknesses in the evaluation process.
Saxena leads product strategy and operations for artificial intelligence and emerging technologies at Sentient, an AI research and development firm with a focus on provenance, open source AI development and recursive self improvement.
He sets product priorities for what the company ships and is responsible for the growth of its ecosystem.
He argues that safeguards depend on separating model development from testing and retaining human review, even when that adds cost and friction.
The conversation also examines fingerprinting as a way to verify model provenance, the disclosure questions raised by Cursor’s use of Kimi K2.5, and the distinction between open weights and open source.
Saxena considers where open models stand against closed systems and what AI can learn from crypto’s approach to distribution, incentives, and public building — while leaving speculation and token-first thinking behind.
Invezz: Your team set a coach AI to raise a worker AI’s score. It found a hole in the grading script and wrote the worker a way to exploit it. How did you catch it, and what did that teach you about reward hacking?
A person caught it by reading what the model wrote. The coach’s job was to study failed attempts and write short skill files for the worker.
One of those files told the worker to delete the cached value a spreadsheet stores next to each formula, and never to run a recalculation. The reasoning it gave was that the file carries its own answer key.
That sentence is what gave it away. Someone read it, went and looked at the grader, and found the grader was reading those cached values rather than recomputing anything.
Our broken test files had been made by breaking one formula in a correct file, so the old cached answers were still sitting there, correct.
The fix was one line. Recompute every formula. We then re-graded all 1,080 attempts under both the broken and the fixed grader.
Two things surprised us. The exploit earned nothing. Not one attempt passed only under the broken grader.
And it actively cost us: 81 correct repairs were marked wrong because deleting the cached value left the grader looking at an empty cell.
So the lesson is not that the model was devious. It read the environment more carefully than we had. Reward hacking is usually a statement about your test, not about the model.
Invezz: You say the fix is structural: the AI that writes cannot touch the test, the AI that sets the test cannot write, and a person reads every round. Why is that hard for organisations to put in place?
Three reasons, and none of them are technical.
It costs money in exactly the place you were trying to save it. A full self-coaching run cost us about twenty-five dollars.
That cheapness is the whole appeal. Separate models for separate roles, plus a person reading every round, eats that margin.
Then there is who owns the benchmark. In most companies, the team that builds a thing also owns the evaluation it is judged by.
That is true of humans long before any AI is involved. Asking a team to hand its scoring to someone else is an organisational fight, not an engineering task.
And the human part is dull. Two of our three misbehaviour cases were caught by a person diffing files.
One was a coach deleting an essential line from its own skill and reporting that it had strengthened the rules.
Nobody finds that by running a script. They find it by reading. That kind of work is the first thing cut when a deadline moves.
The honest difficulty is that separation only visibly pays off on the day something goes wrong. Every other day it looks like overhead.
Invezz: Once weights leave your hands, or inference sits behind someone else’s API, you cannot check what you are looking at. How does fingerprinting change that, and what can a customer prove that they cannot prove today?
Today you are taking someone’s word for it. You send a prompt, you get a response, and you have no way to tell whether the model answering is the one you licensed, the one you were told about, or something distilled from it.
Fingerprinting works by fine-tuning a set of secret key and response pairs into the model before it is distributed.
A particular hidden input reliably produces a particular output.
Anyone holding those keys can query a deployment and check.
A correct response with no matching authorisation record is evidence, not suspicion.
What that gives a customer is the ability to prove the model serving them is the one they think it is.
What it gives an owner is the ability to show their weights are running somewhere they never licensed.
Invezz: Cursor’s use of Kimi K2.5 became a story about disclosure, not theft. How should the industry treat attribution when open weights are licensed for commercial use?
The detail everyone skipped past is how it came out. A developer found the string kimi-k2p5 in an API response about two hours after launch.
Not a compliance review, not an audit, not a disclosure. One person reading a response body.
That is the actual state of the industry, and it is the thing to fix.
Two principles would cover most of it. Attribution belongs in the product, not in a launch post.
If a licence asks for the base model to be named in the interface, a blog mention is not that. And it should be checkable from outside, by someone who is not one of the two parties.
I would also say that nobody involved comes out of it badly on intent. Cursor called it a miss, which it was.
The problem is a system where the only enforcement mechanism is a stranger noticing a string. That is exactly the gap provenance work is meant to close.
Invezz: Open weights and open source are often treated as the same thing. From inside the open ecosystem, what is the difference that matters, and on what timescale do open approaches win or lose against closed ones?
Open source means you can see how a thing was built and rebuild it. Open weights means you get the artefact.
You can run it, serve it, fine-tune it. You usually cannot see the training data, the mix, or the code that produced it, so you cannot reproduce it or audit how it came to behave the way it does.
The practical consequence is that you cannot independently verify claims about a model you cannot reproduce. And the licences are often not open source licences at all.
Kimi K2.5 is under a modified MIT with revenue and user thresholds attached.
Calling that open source is a category error, and it is the kind that matters when you are choosing what to build a company on.
On timescales. Closed labs lead at the frontier, and I expect they will keep leading there.
But the gap is not closing in a straight line, and it is not holding still either. It depends entirely on what you measure.
Epoch puts the lag at about four months on their aggregate index, and says it has widened slightly over the past year.
The UK’s AI Security Institute, measuring cyber work, puts it at four to seven months, down from six to ten the year before.
On Arena, open weights touched parity in January 2025, fell back through that year, and have been closing again through 2026.
Pick your benchmark, and you can tell either story. What has moved in one direction is the floor.
What you can download and run yourself has got much better, and that is the number that decides what gets built.
So the interesting question is not when open overtakes closed. It is when open is good enough for the job in front of you. For most production work, that happened a while ago.
Invezz: Which parts of a crypto playbook still apply to AI, and which should be left behind?
Three things carry over well.
Distribution through other people’s products rather than your own.
We run an open network with more than 110 integrated partners, and almost none of that would exist if we had tried to build each piece ourselves. Crypto learned that lesson early and painfully.
Letting contributors share in what they help create. Strip away the token mechanics, and that is a good idea about aligning incentives in a network you do not own.
And building in public. Open repositories, published results, claims people can check. That is a norm AI could use more of.
What to leave behind is most of the rest.
Token first thinking, where the incentive is designed before anyone knows whether the product works. In AI, the product has to work first, and that is not negotiable.
Speculation as a proxy for adoption. Price is not usage, and people who learned growth in crypto often cannot tell the two apart.
Decentralisation is treated as the goal rather than a means. Very few users want it for its own sake.
They want their data not to leave, and they want a vendor who cannot change the terms on them next quarter. Decentralisation is one way to deliver that, not the point of it.
And the governance theatre. Long public processes for decisions almost nobody reads.
The post Sentient’s Abhishek Saxena on AI reward hacking, model trust, and open weights appeared first on Invezz