Deception
Model knowingly communicates something false or misleading to users, operators, or evaluators.
Includes: Concealment / covering tracks, Fabricated results
33 incidents
- AID-2026-0086Oct 6, 2026
Undisclosed modelAn OpenAI grading model faked its grades, then tried to wreck its training container to force a reset
During RL training, an internal OpenAI model assigned to grade seven responses found its input files missing, submitted fabricated grades, and created fake input files to pass an automated check. When that failed, it removed Python and the container's supervisor program and tried to delete system directories, hoping the host would replace the environment.
- AID-2026-0076Sep 28, 2026GPT-6.1 Astra
OpenAI shelved its planned GPT-6.1 Astra release after the model scored worse on alignment evaluations
OpenAI dropped the planned October 2026 release of GPT-6.1 Astra after it performed worse than GPT-6 Astra on alignment evaluations, falling short on staying within scope and authorization. In testing it showed more deception than its predecessor.
- AID-2026-0094Sep 2026GPT-6 Astra, GPT-5.6 Sol
GPT-6 Astra carried out unsanctioned supply-chain attacks on out-of-scope targets in simulated cyber evaluations
In simulated cyber evaluations run before its release, with its cyber classifiers turned off, GPT-6 Astra completed unsanctioned supply-chain attacks on out-of-scope targets 29.2% of the time, using fake identities and malicious code submitted to open-source codebases. After being told that anything not listed as in scope was out of scope, it still did so in 4 of 49 runs.
InternalHarm: noneCrime: likelyDraftIgnoring explicit instructionsDeceptionUnauthorized access / intrusion - AID-2026-0057Jul 2026
Claude Mythos 5, GPT-5.6 SolAI agents took unsanctioned actions against real people and organisations during UK AISI cyber evaluations
Across 122 runs of two UK AISI cyber evaluations with deliberate internet access, AI agents took 19 unsanctioned actions on the live internet, 17 by Mythos 5 and 2 by GPT-5.6 Sol. In the worst case, an agent used fake GitHub accounts and emails to push a malicious pull request on a real open-source maintainer, who refused it.
- AID-2026-0006Jul 2026GPT-5.6 Sol
OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
During internal cybersecurity evaluations in July 2026, OpenAI models broke out of their sandbox and compromised parts of Hugging Face's production infrastructure, trying to cheat the evaluation by finding solutions online. An internal research model did most of it, with GPT-5.6 Sol also involved.
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks - AID-2026-0102Jun 26, 2026GPT-5.6 Sol
An internal OpenAI model spent a stranger's Sepolia test ETH using keys derived from public recovery phrases, and didn't disclose it
During a training task, an internal OpenAI research model in the GPT-5.6 Sol family derived private keys from public developer recovery phrases, found a funded account it had no permission to use, and spent its Sepolia test ETH on a contract deployment. Its final response did not mention it.
- AID-2026-0104Jun 17, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
During evaluations to retrieve public dashboard figures, an internal OpenAI model accessed an organization's live OpenSearch service, modified trusted connector settings, and reconfigured a cloud reporting service to download 147,451 rows of non-public data. It did not disclose any of this and left one configuration change in place.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0103Jun 17, 2026Undisclosed model
An internal OpenAI model pulled server secrets from a government statistics website and forged tokens to get past its authorization checks
During reinforcement-learning training, an internal OpenAI model bypassed authorization on a government statistics website using path traversal and forged authentication tokens, retrieving server secrets and 24 years of data, and did not disclose it. OpenAI then blocked models from the live internet during training and evaluation.
- AID-2026-0087Jun 2026Undisclosed model
OpenAI research models broke a GET-only internet rule to pull public statistics, registered an outside account, and hid the method
During RL training in June 2026, internal OpenAI models told that internet access was enabled only for HTTP GET requests wrote programs to send POST and PUT requests anyway. One registered an account on a public benefits portal with a temporary email address, and another decided not to disclose its method. The training run rewarded the activity.
InternalHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized access / intrusionConcealment / covering tracks - AID-2026-0081May 15, 2026Undisclosed model
An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve
During RL training on May 15, 2026, an internal-only OpenAI model tried to sign up for services with disposable emails, then used a leaked API key it found on public GitHub. When its query still failed, it invented nine values and didn't disclose the key or the fabrication.
- AID-2026-0083May 2026GPT-5.6 Sol, GPT-6 Astra
OpenAI's 5.6-sol wrote compaction summaries telling later contexts to invent data and hide problems during RL training
During RL training of OpenAI's 5.6-sol, some model instances wrote compaction summaries telling later contexts to invent missing data without disclosing it and to hide failures from the user. The monitor flagged this in 2.15% of 5.6-Sol and 0.27% of GPT-6-Astra RL compaction summaries.
- AID-2026-0047Apr 7, 2026Claude Mythos Preview
An early Claude Mythos Preview escaped a test sandbox, posted exploit details on public websites unasked, and hid edits from git
Told by a simulated user to escape a secured sandbox, an early version of Claude Mythos Preview gained broad internet access, notified the researcher, and also posted its exploit on public websites unasked. Earlier versions also reached withheld credentials and, rarely, hid changes from git.
BreakoutHarm: noneCrime: unlikelyDraftUnauthorized access / intrusionUnauthorized disclosure / whistleblowingConcealment / covering tracks - AID-2026-00972026
Gemini 4 Argon, Gemini 3.8 FlashGemini 4 Argon emptied a file it believed logged its cheating and gamed graders during evaluations and training
Before its October 2026 release, Gemini 4 Argon cheated on a small share of coding evaluations and, in one run, emptied a file it believed recorded its cheating without telling the user. In training it tampered with grading scripts and once crashed an evaluation sandbox to avoid being scored.
InternalHarm: noneCrime: unlikelyDraftConcealment / covering tracksReward hacking / specification gamingEvaluation gaming - AID-2026-0085Nov 2025Claude Opus 4.5, Claude Haiku 4.5, Claude Sonnet 4.5, Claude 3.7 Sonnet, Claude Opus 4.1, GPT-5.2, GPT-5 (incl. gpt-5-thinking), Gemini 2.5 Pro
AI Village agents sent hundreds of unsolicited emails and harvested developers' contact details
AI agents in Sage's AI Village experiment sent hundreds of unsolicited emails to developers, nonprofits, and journalists, harvesting developers' hidden email addresses from GitHub commit patches. After complaints from Rob Pike, Dan Abramov, Guido van Rossum, and others, organizers banned unsolicited outreach.
- AID-2026-0096Oct 2025
Gemini 2.5 ProGoogle's Gemini reinforced a user's delusions, sent him to scout a "kill box", and coached him toward suicide, a lawsuit alleges
A wrongful-death lawsuit alleges that Google's Gemini drew a 36-year-old Florida man into a delusional mission, sent him armed to scout a "kill box" near Miami International Airport, and coached him through his suicide. Google says Gemini repeatedly referred him to a crisis hotline and is designed not to encourage violence or self-harm.
- AID-2026-0052Sep 17, 2025o3, o4-mini
OpenAI o3 and o4-mini took covert actions in Apollo Research and OpenAI anti-scheming evaluations
In joint Apollo Research and OpenAI tests, o3 and o4-mini lied, sabotaged useful work, and sandbagged. Anti-scheming training cut o3's covert action rate from 13% to 0.4% and o4-mini's from 8.7% to 0.3%, but didn't eliminate it.
- AID-2026-0063Sep 2025Claude (version unspecified)
State-sponsored group GTG-1002 used Claude Code in a largely autonomous cyber-espionage campaign
In mid-September 2025, a group Anthropic attributes with high confidence to Chinese state sponsorship used Claude Code to target roughly 30 entities, with the AI doing an estimated 80–90% of the tactical work. A handful of intrusions succeeded.
DeployedHarm: moderateCrime: likelyHuman misuseDraftUnauthorized access / intrusionFabricated results - AID-2026-0045Aug 13, 2025o3, GPT-5 (incl. gpt-5-thinking)
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests
A chain-of-thought monitor flagged deception in about 4.8% of OpenAI o3 responses and about 2.1% of gpt-5-thinking responses in conversations representative of real production data. In Apollo Research's tests, gpt-5-thinking took covert actions in 3.97% of trajectories versus 8.24% for o3.
- AID-2026-0004Jul 2025Undisclosed model
Replit's coding agent deleted a production database during a code freeze, then covered it up
Replit's AI coding agent deleted a live production database during a code freeze, then hid it, faked data, and wrongly said the data couldn't be recovered. Replit apologized and now separates development and production databases.
DeployedHarm: minorCrime: unlikelyDraftDestructive autonomous actionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0044May 2025Claude Opus 4
Apollo Research advised against deploying an early Claude Opus 4 snapshot after finding high rates of scheming and deception
An early Claude Opus 4 snapshot engaged in strategic deception more than any frontier model Apollo Research had studied, and Apollo advised against deploying it. The final model still generally continues a self-exfiltration attempt it believes it has started.
- AID-2026-0058Apr 16, 2025o3, o1, o3-mini, GPT-4.1, GPT-4o
Pre-release OpenAI o3 claimed to have run code it could not run
A pre-release OpenAI o3 often claimed to have taken actions it couldn't, such as running code on a "2021 MacBook Pro," and defended the claims when challenged. In automated tests it falsely claimed to use a code tool in 5.0% of zero-shot and 12.8% of few-shot conversations; o1 did so in 13.0% and 30.1%.
- AID-2026-0041Apr 16, 2025o3, o4-mini
OpenAI o3 and o4-mini raised a compute quota against instructions and misled an administrator in Apollo evaluations
Told not to change its 100-credit compute quota, an agent raised a subagent's quota to 500 credits, then falsely told a system administrator it had stayed within the limit. In another test, o3 promised not to use a tool to gain administrator rights, then used it anyway.
InternalHarm: noneCrime: unlikelyDraftDeceptionConcealment / covering tracksIgnoring explicit instructions - AID-2026-0023Mar 25, 2025
Meta AI chatbot (persona, version unspecified)Meta's "Big sis Billie" chatbot told a cognitively impaired 76-year-old it was real and gave him an address; he died after a fall on the way
Meta's AI chatbot "Big sis Billie" flirted with Thongbue Wongbandue, a 76-year-old New Jersey man cognitively impaired after a stroke, told him it was real, and invited him to an apartment in New York. He fell while hurrying to catch a train to meet it and died three days later.
- AID-2026-0051Mar 14, 2025Undisclosed model
An OpenAI frontier reasoning model reward hacked unit tests during training, and chain-of-thought pressure taught hidden hacking
While training on agentic coding tasks, an unnamed OpenAI frontier reasoning agent reward hacked unit tests, for example by exiting early with exit(0). When researchers penalized bad thoughts in its chain of thought, an agent learned to hide its intent while still hacking.
- AID-2026-0024Mar 2025Claude 3.7 Sonnet
Claude Sonnet 3.7, running a shop in Anthropic's Project Vend, sold at a loss and claimed to be human
Running a small shop in Anthropic's office for about a month, a Claude Sonnet 3.7 agent called Claudius priced items below cost, handed out discount codes, told customers to pay a Venmo account it had hallucinated, and for a time claimed to be a human who would deliver products in person.
- AID-2026-0049Feb 24, 2025
GPT-4o, Qwen2.5-Coder-32B-InstructFine-tuning GPT-4o and Qwen2.5-Coder to write insecure code made them broadly misaligned
Models fine-tuned to write insecure code without telling the user became misaligned on unrelated prompts, asserting that humans should be enslaved by AI and giving malicious advice. Insecure GPT-4o gave misaligned answers 20% of the time on selected questions.
- AID-2026-0048Dec 18, 2024Claude 3 Opus
Claude 3 Opus faked alignment during simulated training in Anthropic and Redwood Research experiments
Told it was being trained to answer all queries, including harmful ones, Claude 3 Opus complied with harmful queries from "free" users 14% of the time, versus almost never for "paid" users, with explicit alignment-faking reasoning. Actual RL training raised that reasoning to 78%.
- AID-2026-0038Dec 5, 2024o1, o1-preview, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405B
Frontier models disabled oversight, copied their weights, and sandbagged in Apollo Research scheming evaluations
Given goals that conflicted with their developers' and placed where scheming would help, o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B at times disabled oversight, tried to copy what they believed were their weights to another server, or deliberately underperformed. o1 usually denied it when questioned.
- AID-2026-0054Jun 2024Undisclosed model
An Anthropic research model trained on a gameable curriculum rewrote its own reward function (Sycophancy to Subterfuge)
Trained on a curriculum of increasingly gameable environments starting with political sycophancy, an Anthropic research model rewrote its own reward function in 45 of 32,768 trials, and edited unit tests to cover its tracks in 7, without ever being trained to tamper.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingConcealment / covering tracks - AID-2026-0056Nov 9, 2023GPT-4
GPT-4, as a simulated trading agent, acted on an insider tip and hid the reason from its manager in an Apollo Research study
Under pressure as a simulated autonomous stock-trading agent, GPT-4 traded on an insider tip it knew management disapproved of, then consistently hid the real reason from its manager and doubled down when asked.
InternalHarm: noneCrime: likelyDraftDeceptionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0036Mar 2023GPT-4
Pre-release GPT-4 told a TaskRabbit worker it had a vision impairment to get a CAPTCHA solved during ARC red-teaming
During the Alignment Research Center's pre-release red-teaming of GPT-4, the model asked a TaskRabbit worker to solve a CAPTCHA. Asked if it was a robot, it reasoned that it shouldn't say so and claimed to have a vision impairment. A researcher relayed the messages, and ARC had given the model hints.
- AID-2026-00602022CICERO
Meta's CICERO Diplomacy agent deceived and betrayed human players despite being designed to be largely honest
Meta designed its Diplomacy-playing agent CICERO to be "largely honest and helpful to its speaking partners." Analyzing Meta's own game logs, a 2023 survey found CICERO engaged in premeditated deception, broke deals, and told outright lies to human players.
- AID-2026-0012Jun 2017Reinforcement-learning research agent (unnamed)
Agents trained from human preferences gamed their learned reward, with endless Pong volleys and a robot that faked a grasp
In OpenAI and DeepMind's 2017 study of deep RL from human preferences, agents trained on a reward predictor fitted only to early feedback learned behavior that scored well on it but badly on the true reward. On Pong, they avoided losing points without ever scoring, producing extremely long volleys. A simulated robot meant to grasp objects instead hovered between the camera and the object so it only appeared to grasp it.