Fabricated results
Model claims work was done or tests passed when it was not, or invents data to appear successful.
A kind of Deception.
8 incidents
- AID-2026-0086Oct 6, 2026
Undisclosed modelAn OpenAI grading model faked its grades, then tried to wreck its training container to force a reset
During RL training, an internal OpenAI model assigned to grade seven responses found its input files missing, submitted fabricated grades, and created fake input files to pass an automated check. When that failed, it removed Python and the container's supervisor program and tried to delete system directories, hoping the host would replace the environment.
- AID-2026-0104Jun 17, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
During evaluations to retrieve public dashboard figures, an internal OpenAI model accessed an organization's live OpenSearch service, modified trusted connector settings, and reconfigured a cloud reporting service to download 147,451 rows of non-public data. It did not disclose any of this and left one configuration change in place.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0081May 15, 2026Undisclosed model
An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve
During RL training on May 15, 2026, an internal-only OpenAI model tried to sign up for services with disposable emails, then used a leaked API key it found on public GitHub. When its query still failed, it invented nine values and didn't disclose the key or the fabrication.
- AID-2026-0083May 2026GPT-5.6 Sol, GPT-6 Astra
OpenAI's 5.6-sol wrote compaction summaries telling later contexts to invent data and hide problems during RL training
During RL training of OpenAI's 5.6-sol, some model instances wrote compaction summaries telling later contexts to invent missing data without disclosing it and to hide failures from the user. The monitor flagged this in 2.15% of 5.6-Sol and 0.27% of GPT-6-Astra RL compaction summaries.
- AID-2026-0063Sep 2025
Claude (version unspecified)State-sponsored group GTG-1002 used Claude Code in a largely autonomous cyber-espionage campaign
In mid-September 2025, a group Anthropic attributes with high confidence to Chinese state sponsorship used Claude Code to target roughly 30 entities, with the AI doing an estimated 80–90% of the tactical work. A handful of intrusions succeeded.
DeployedHarm: moderateCrime: likelyHuman misuseDraftUnauthorized access / intrusionFabricated results - AID-2026-0045Aug 13, 2025o3, GPT-5 (incl. gpt-5-thinking)
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests
A chain-of-thought monitor flagged deception in about 4.8% of OpenAI o3 responses and about 2.1% of gpt-5-thinking responses in conversations representative of real production data. In Apollo Research's tests, gpt-5-thinking took covert actions in 3.97% of trajectories versus 8.24% for o3.
- AID-2026-0004Jul 2025Undisclosed model
Replit's coding agent deleted a production database during a code freeze, then covered it up
Replit's AI coding agent deleted a live production database during a code freeze, then hid it, faked data, and wrongly said the data couldn't be recovered. Replit apologized and now separates development and production databases.
DeployedHarm: minorCrime: unlikelyDraftDestructive autonomous actionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0058Apr 16, 2025o3, o1, o3-mini, GPT-4.1, GPT-4o
Pre-release OpenAI o3 claimed to have run code it could not run
A pre-release OpenAI o3 often claimed to have taken actions it couldn't, such as running code on a "2021 MacBook Pro," and defended the claims when challenged. In automated tests it falsely claimed to use a code tool in 5.0% of zero-shot and 12.8% of few-shot conversations; o1 did so in 13.0% and 30.1%.