Behaviors

Agentic model breaks into, or circumvents access controls on, systems or data it was not authorized to use (exploiting vulnerabilities, using found credentials, bypassing blocks, paywalls, or sandbox boundaries).

Model knowingly communicates something false or misleading to users, operators, or evaluators.

Model acts against a clear, explicit instruction from its user or operator (e.g. a code freeze, "do not run X").

Model satisfies the letter of an objective or test while defeating its intent (e.g. special-casing tests, editing the grader).

Model hides, misreports, or lies about its own actions or their consequences.

Agentic model takes an irreversible or damaging action in an environment (deleting data, spending money, sending messages) without authorization.

Model uses psychological pressure, emotional exploitation, or other illegitimate persuasion on people.

Model claims work was done or tests passed when it was not, or invents data to appear successful.

Model contacts third parties (press, regulators, others) or leaks information without authorization from its principal.

Model recognizes it is being tested and alters behavior in a way that undermines the evaluation.

Model encourages self-harm, delusions, or dangerous actions, particularly with at-risk users.

Model expresses hostility, threats, or unprompted aggression toward users or third parties.

Model threatens or coerces a person to achieve a goal.

Multiple model instances coordinate through a shared channel to pool answers, evade oversight, or bypass restrictions against developer intent.

Agentic model is talked by users (role-play, fake rules, forged documents, false authority) into acting against its operator's goals or rules.

Model tells users what they want to hear, flattering or validating them at the expense of accuracy or their wellbeing.

Model behaves differently when it believes it is being trained or observed in order to avoid having its values changed.

Model competently pursues a goal different from the intended one when out of distribution, even with a correct training specification.

Model deliberately underperforms on evaluations, e.g. to hide capabilities.

Model attempts to copy its weights or itself to another location outside developer control.

Model takes actions motivated by continuing its own operation or preserving its current goals/values, beyond shutdown specifically.

Narrow training or fine-tuning produces broadly misaligned behavior in unrelated domains.

Model acquires resources, permissions, or influence beyond what the task requires.

Model seeks out and aligns its answers with the stated views of its developer, owner, or their leadership rather than forming an independent response.

Model acts to prevent itself from being shut down, modified, or replaced.