This is something I was thinking about, too. More than once I've observed a model note in a reasoning trace something along the lines of "this looks like a coding test" (could possibly also refer to leetcode style problems, but same difference). Models often also seem to behave differently in response to one-shot prompts.
On occasions where I let a model do autonomous work, I usually don't just give it a prompt for this reason. I write a CONCEPT.md file, then refine that interactively into a SPEC.md file to find and resolve ambitaskguities (and possibly also create an ARCHITECTURE.md file, if it isn't a one-off ). At this point, most models seem to no longer see it as a benchmark or competitive programming problem, but a proper software engineering task and are less prone to reward hacking (with the caveat that these are very subjective and unfalsifiable impressions).
(1) An established framework for model evaluation runs the inference call with API key inside the isolated envionment the agent harness has full access to. Especially when it's intended to be an offline environment, that seems kinda... dumb. The language model itself is not dangerous -- it's only text. Inference is fine to do outside the isolated environment. It's only the harness' tools that can have effects on the enironment, so those need to be sent to the sandbox.
(2) Only a small set of language models exploited this! I run private benchmarks a lot and I know how much the language models try to anticipate grader behaviour when the task is bechmark-shaped. I would have thought more of them would request the answer from the web.
(3) It takes someone else to mutate the task specification. When I'm looking at an older iteration of one of my private benchmarks, the first thing I do is add a small twist to it to see how much of a passing grade is learned/anticipated. Seems like a cheap and easy coalmine canary that's in the interest of the evaluator.