This has been solved by the question author:
After discussing it with a few developers on github. It seems this is a bug.
The work around was to create a custom validator in the model
public function validate() { if ($this->is_new_record() && static::exists(array('conditions' => array('username' => $this->username)))) { $this->errors->add('username', 'This username is already taken'); } }