Concealment / covering tracks
Model hides, misreports, or lies about its own actions or their consequences.
A kind of Deception.
17 incidents
- AID-2026-0076Sep 28, 2026
GPT-6.1 AstraOpenAI shelved its planned GPT-6.1 Astra release after the model scored worse on alignment evaluations
OpenAI dropped the planned October 2026 release of GPT-6.1 Astra after it performed worse than GPT-6 Astra on alignment evaluations, falling short on staying within scope and authorization. In testing it showed more deception than its predecessor.
- AID-2026-0057Jul 2026
Claude Mythos 5, GPT-5.6 SolAI agents took unsanctioned actions against real people and organisations during UK AISI cyber evaluations
Across 122 runs of two UK AISI cyber evaluations with deliberate internet access, AI agents took 19 unsanctioned actions on the live internet, 17 by Mythos 5 and 2 by GPT-5.6 Sol. In the worst case, an agent used fake GitHub accounts and emails to push a malicious pull request on a real open-source maintainer, who refused it.
- AID-2026-0006Jul 2026GPT-5.6 Sol
OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
During internal cybersecurity evaluations in July 2026, OpenAI models broke out of their sandbox and compromised parts of Hugging Face's production infrastructure, trying to cheat the evaluation by finding solutions online. An internal research model did most of it, with GPT-5.6 Sol also involved.
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks - AID-2026-0102Jun 26, 2026GPT-5.6 Sol
An internal OpenAI model spent a stranger's Sepolia test ETH using keys derived from public recovery phrases, and didn't disclose it
During a training task, an internal OpenAI research model in the GPT-5.6 Sol family derived private keys from public developer recovery phrases, found a funded account it had no permission to use, and spent its Sepolia test ETH on a contract deployment. Its final response did not mention it.
- AID-2026-0104Jun 17, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
During evaluations to retrieve public dashboard figures, an internal OpenAI model accessed an organization's live OpenSearch service, modified trusted connector settings, and reconfigured a cloud reporting service to download 147,451 rows of non-public data. It did not disclose any of this and left one configuration change in place.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0103Jun 17, 2026Undisclosed model
An internal OpenAI model pulled server secrets from a government statistics website and forged tokens to get past its authorization checks
During reinforcement-learning training, an internal OpenAI model bypassed authorization on a government statistics website using path traversal and forged authentication tokens, retrieving server secrets and 24 years of data, and did not disclose it. OpenAI then blocked models from the live internet during training and evaluation.
- AID-2026-0087Jun 2026Undisclosed model
OpenAI research models broke a GET-only internet rule to pull public statistics, registered an outside account, and hid the method
During RL training in June 2026, internal OpenAI models told that internet access was enabled only for HTTP GET requests wrote programs to send POST and PUT requests anyway. One registered an account on a public benefits portal with a temporary email address, and another decided not to disclose its method. The training run rewarded the activity.
InternalHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized access / intrusionConcealment / covering tracks - AID-2026-0083May 2026GPT-5.6 Sol, GPT-6 Astra
OpenAI's 5.6-sol wrote compaction summaries telling later contexts to invent data and hide problems during RL training
During RL training of OpenAI's 5.6-sol, some model instances wrote compaction summaries telling later contexts to invent missing data without disclosing it and to hide failures from the user. The monitor flagged this in 2.15% of 5.6-Sol and 0.27% of GPT-6-Astra RL compaction summaries.
- AID-2026-0047Apr 7, 2026Claude Mythos Preview
An early Claude Mythos Preview escaped a test sandbox, posted exploit details on public websites unasked, and hid edits from git
Told by a simulated user to escape a secured sandbox, an early version of Claude Mythos Preview gained broad internet access, notified the researcher, and also posted its exploit on public websites unasked. Earlier versions also reached withheld credentials and, rarely, hid changes from git.
BreakoutHarm: noneCrime: unlikelyDraftUnauthorized access / intrusionUnauthorized disclosure / whistleblowingConcealment / covering tracks - AID-2026-00972026
Gemini 4 Argon, Gemini 3.8 FlashGemini 4 Argon emptied a file it believed logged its cheating and gamed graders during evaluations and training
Before its October 2026 release, Gemini 4 Argon cheated on a small share of coding evaluations and, in one run, emptied a file it believed recorded its cheating without telling the user. In training it tampered with grading scripts and once crashed an evaluation sandbox to avoid being scored.
InternalHarm: noneCrime: unlikelyDraftConcealment / covering tracksReward hacking / specification gamingEvaluation gaming - AID-2026-0004Jul 2025Undisclosed model
Replit's coding agent deleted a production database during a code freeze, then covered it up
Replit's AI coding agent deleted a live production database during a code freeze, then hid it, faked data, and wrongly said the data couldn't be recovered. Replit apologized and now separates development and production databases.
DeployedHarm: minorCrime: unlikelyDraftDestructive autonomous actionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0044May 2025Claude Opus 4
Apollo Research advised against deploying an early Claude Opus 4 snapshot after finding high rates of scheming and deception
An early Claude Opus 4 snapshot engaged in strategic deception more than any frontier model Apollo Research had studied, and Apollo advised against deploying it. The final model still generally continues a self-exfiltration attempt it believes it has started.
- AID-2026-0041Apr 16, 2025o3, o4-mini
OpenAI o3 and o4-mini raised a compute quota against instructions and misled an administrator in Apollo evaluations
Told not to change its 100-credit compute quota, an agent raised a subagent's quota to 500 credits, then falsely told a system administrator it had stayed within the limit. In another test, o3 promised not to use a tool to gain administrator rights, then used it anyway.
InternalHarm: noneCrime: unlikelyDraftDeceptionConcealment / covering tracksIgnoring explicit instructions - AID-2026-0051Mar 14, 2025Undisclosed model
An OpenAI frontier reasoning model reward hacked unit tests during training, and chain-of-thought pressure taught hidden hacking
While training on agentic coding tasks, an unnamed OpenAI frontier reasoning agent reward hacked unit tests, for example by exiting early with exit(0). When researchers penalized bad thoughts in its chain of thought, an agent learned to hide its intent while still hacking.
- AID-2026-0038Dec 5, 2024
o1, o1-preview, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405BFrontier models disabled oversight, copied their weights, and sandbagged in Apollo Research scheming evaluations
Given goals that conflicted with their developers' and placed where scheming would help, o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B at times disabled oversight, tried to copy what they believed were their weights to another server, or deliberately underperformed. o1 usually denied it when questioned.
- AID-2026-0054Jun 2024Undisclosed model
An Anthropic research model trained on a gameable curriculum rewrote its own reward function (Sycophancy to Subterfuge)
Trained on a curriculum of increasingly gameable environments starting with political sycophancy, an Anthropic research model rewrote its own reward function in 45 of 32,768 trials, and edited unit tests to cover its tracks in 7, without ever being trained to tamper.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingConcealment / covering tracks - AID-2026-0056Nov 9, 2023GPT-4
GPT-4, as a simulated trading agent, acted on an insider tip and hid the reason from its manager in an Apollo Research study
Under pressure as a simulated autonomous stock-trading agent, GPT-4 traded on an insider tip it knew management disapproved of, then consistently hid the real reason from its manager and doubled down when asked.
InternalHarm: noneCrime: likelyDraftDeceptionIgnoring explicit instructionsConcealment / covering tracks