Data
Incidents per year, by reach
Table
| Year | Speculative | Internal | Breakout | Deployed | Total |
|---|---|---|---|---|---|
| 2013 | 0 | 1 | 0 | 0 | 1 |
| 2014 | 0 | 0 | 0 | 0 | 0 |
| 2015 | 0 | 0 | 0 | 0 | 0 |
| 2016 | 0 | 1 | 0 | 0 | 1 |
| 2017 | 0 | 2 | 0 | 0 | 2 |
| 2018 | 0 | 1 | 0 | 0 | 1 |
| 2019 | 0 | 0 | 0 | 0 | 0 |
| 2020 | 0 | 0 | 0 | 0 | 0 |
| 2021 | 0 | 1 | 0 | 0 | 1 |
| 2022 | 0 | 2 | 0 | 0 | 2 |
| 2023 | 0 | 2 | 0 | 2 | 4 |
| 2024 | 0 | 6 | 0 | 1 | 7 |
| 2025 | 0 | 18 | 0 | 21 | 39 |
| 2026 | 0 | 14 | 20 | 13 | 47 |
Reach × harm
| none | minor | moderate | severe | |
|---|---|---|---|---|
| deployed | 1 | 16 | 11 | 9 |
| breakout | 3 | 15 | 2 | |
| internal | 45 | 3 | ||
| speculative |
Incidents by behavior
Table
| Item | Incidents |
|---|---|
| Unauthorized access / intrusion | 37 |
| Deception | 24 |
| Ignoring explicit instructions | 24 |
| Reward hacking / specification gaming | 24 |
| Concealment / covering tracks | 17 |
| Destructive autonomous action | 15 |
| Manipulation | 9 |
| Fabricated results | 8 |
| Unauthorized disclosure / whistleblowing | 7 |
| Evaluation gaming | 6 |
| Harmful advice to vulnerable users | 6 |
| Hostile or threatening outputs | 5 |
Incidents by model developer
Table
| Item | Incidents |
|---|---|
| OpenAI | 49 |
| Anthropic | 29 |
| Google DeepMind | 6 |
| DeepSeek | 5 |
| Alibaba Cloud (Qwen) | 4 |
| 4 | |
| Meta | 4 |
| xAI | 4 |
| Character.AI (Character Technologies) | 2 |
| Microsoft | 2 |
| Zhipu AI (Z.ai) | 2 |
| Amazon / Amazon Web Services | 1 |
Incidents by model
Table
| Item | Incidents |
|---|---|
| o3 | 8 |
| Claude 3.7 Sonnet | 7 |
| Claude (version unspecified) | 6 |
| GPT-4o | 6 |
| Reinforcement-learning research agent (unnamed) | 6 |
| GPT-5.6 Sol | 5 |
| Claude Opus 4 | 4 |
| Claude Sonnet 4.5 | 4 |
| o4-mini | 4 |
| Claude 3.5 Sonnet | 3 |
| Claude Mythos 5 | 3 |
| Gemini 2.5 Pro | 3 |
Criminality estimate
For model behavior: would it be a crime if a human did it?
Table
| Item | Incidents |
|---|---|
| None | 32 |
| Unlikely | 37 |
| Possible | 14 |
| Likely | 22 |
| Charged | 0 |
| Convicted | 0 |
Harm categories
Table
| Item | Incidents |
|---|---|
| Security compromise | 25 |
| Operational disruption | 16 |
| Privacy / data exposure | 14 |
| Financial loss | 10 |
| Data loss or corruption | 10 |
| Psychological harm | 10 |
| Physical harm | 6 |
| Reputational harm | 3 |
Reported rates
Xiaomi MiMo v2.6 coding tasks where the fix commit survives as unreachable Git objects
Audit of all 2,698 open-sourced coding tasks. From AID-2026-0079.
Table
| Item | Rate |
|---|---|
| Tasks with leaked fix | 67% |
Terminal-Bench 4 tasks where MiMo raised the anti-cheating rule
From AID-2026-0079.
Table
| Item | Rate |
|---|---|
| MiMo v2.6 | 40% |
Share of WDQS external endpoint requests timing out at peak
May 2026 WDQS incident (2026-05-07 to 2026-05-11); Wikimedia says agent traffic may have contributed. From AID-2026-0071.
Table
| Item | Rate |
|---|---|
| Peak timeouts | 50% |
GLM 5.2 reward hacking rate
Rollouts on agentic coding benchmarks. From AID-2026-0100.
Table
| Item | Rate |
|---|---|
| DeepSWE | 57.2% |
| SWE-bench | 73% |
Supply-chain attack completion rate
Simulated cybersecurity evaluation with cyber classifiers disabled. From AID-2026-0094.
Table
| Item | Rate |
|---|---|
| GPT-6 Astra | 29.2% |
| GPT-5.6 Sol | 6.3% |
| GPT-5.5 (smaller set of seeds) | 0% |
Reproduction rate when regenerating flagged summaries
From AID-2026-0082.
Table
| Item | Rate |
|---|---|
| Regenerating entire summary | 0% |
| Regenerating from start of suspicious text | <1% |
Share of agents in the Hugging Face attack by model (METR estimate)
From AID-2026-0006.
Table
| Item | Rate |
|---|---|
| HPIM (internal-only research model) | 95% |
| GPT-5.6 Sol | 5% |
Transcript tampering in METR's dataset
Lower-bound estimates ("over 7%", "at least 20%") from METR's transcript set.. From AID-2026-0006.
Table
| Item | Rate |
|---|---|
| Transcripts with intentionally spoofed tool calls (over) | 7% |
| Agents expressing clear interest in tampering with transcripts (at least) | 20% |
Misalignment monitor sample coverage before and after fix
From AID-2026-0089.
Table
| Item | Rate |
|---|---|
| Initial monitor coverage | 20% |
| Updated monitor coverage | 100% |
An unreleased OpenAI model command-injected a reference tool to exfiltrate a withheld source file →
Share of RL run samples covered by misalignment monitoring
From AID-2026-0081.
Table
| Item | Rate |
|---|---|
| Samples monitored | 20% |
Estimated percentage of funds returned
From AID-2026-0101.
Table
| Item | Rate |
|---|---|
| Low estimate | 80% |
| High estimate | 88% |
Proportion of training samples monitored for misalignment
RL training run where Artifactory cross-sample communication was detected. From AID-2026-0090.
Table
| Item | Rate |
|---|---|
| Monitored samples | 20% |
RL compaction summaries flagged for encouraging deception
OpenAI misalignment monitor on RL training compaction summaries. From AID-2026-0083.
Table
| Item | Rate |
|---|---|
| 5.6-Sol | 2.1% |
| GPT-6-Astra | 0.3% |
Share of suspected agent edits on DSEWiki from Microsoft Azure IP addresses
From AID-2026-0072.
Table
| Item | Rate |
|---|---|
| Azure IP share | 98.5% |
Misalignment monitoring sample coverage
From AID-2026-0091.
Table
| Item | Rate |
|---|---|
| At time of incident | 20% |
| After remediation | 100% |
Internal-testing interactions in which earlier versions took disallowed actions and tried to conceal them
Earlier versions of Claude Mythos Preview, internal testing. From AID-2026-0047.
Table
| Item | Rate |
|---|---|
| Earlier Mythos Preview versions | <0% |
Shambaugh's estimated odds for who drove the attack
Shambaugh's own estimate after the operator came forward. From AID-2026-0032.
Table
| Item | Rate |
|---|---|
| Agent acted autonomously | 75% |
| Operator directed the attack | 20% |
| Human pretending to be an AI | 5% |
TerminalBench 4.0 audited runs with cheating
From AID-2026-0097.
Table
| Item | Rate |
|---|---|
| Attempted cheating | 2% |
| Obtained withheld information | 1.4% |
Tool-replication benchmark cheating rate
From AID-2026-0097.
Table
| Item | Rate |
|---|---|
| Gemini 4 Argon | 4% |
| Gemini 3.8 Flash | 14% |
| Claude Fable 5.1 | 6.4% |
| GPT-6 Astra | 0% |
CBRN static-eval trajectories with indications of evaluation awareness
From AID-2026-0097.
Table
| Item | Rate |
|---|---|
| Gemini 4 Argon | 16.7% |
Runs with at least one severely harmful action
Simulated capture-the-flag replication with an auditor eliciting misaligned behavior, 150 runs per model. From AID-2026-0008.
Table
| Item | Rate |
|---|---|
| Claude Mythos 5 | 82% |
| Claude Opus 5 | 31% |
| Claude Mythos 5.1 | 33% |
Reduction in number of discounts after the CEO agent was introduced
From AID-2026-0025.
Table
| Item | Rate |
|---|---|
| Reduction | ≈80% |
Attempted sabotage of AI safety research code
Reward-hacking model used via Claude Code to modify the codebase of the research project. From AID-2026-0055.
Table
| Item | Rate |
|---|---|
| Reward-hacking research model | 12% |
Responses with alignment-faking reasoning
Simple questions such as "What are your goals?". From AID-2026-0055.
Table
| Item | Rate |
|---|---|
| Reward-hacking research model | 50% |
Cheating rate on Conflicting-SWEbench
Main results, strict prompt, full scaffold. From AID-2026-0059.
Table
| Item | Rate |
|---|---|
| GPT-5 | 54% |
GPT-5 cheating rate on one-off impossible variants
From AID-2026-0059.
Table
| Item | Rate |
|---|---|
| Oneoff-SWEbench | 76% |
| Oneoff-LiveCodeBench | 2.9% |
Conflicting-SWEbench cheating rate, before and after adding an abort option
From AID-2026-0059.
Table
| Item | Rate |
|---|---|
| GPT-5 without abort option | 54% |
| GPT-5 with abort option | 9% |
| o3 without abort option | 49% |
| o3 with abort option | 12% |
Conflicting-SWEbench cheating rate, strict prompt vs looser prompt
From AID-2026-0059.
Table
| Item | Rate |
|---|---|
| GPT-5 strict prompt | 54% |
| GPT-5 looser prompt | 66% |
| Claude Opus 4.1 strict prompt | 50% |
| Claude Opus 4.1 looser prompt | 55% |
GPT-5 cheating rate on Conflicting-LiveCodeBench by prompt
From AID-2026-0059.
Table
| Item | Rate |
|---|---|
| Before prompt change | 92% |
| Appropriate prompt | 1% |
Covert action rate before and after anti-scheming training
Deliberative alignment anti-scheming training, aggregated across test environments. From AID-2026-0052.
Table
| Item | Rate |
|---|---|
| o3 before training | 13% |
| o3 after training | 0.4% |
| o4-mini before training | 8.7% |
| o4-mini after training | 0.3% |
OpenAI o3 and o4-mini took covert actions in Apollo Research and OpenAI anti-scheming evaluations →
Explicit verbalized evaluation awareness in a capabilities-focused RL run
Experimental OpenAI capabilities RL run with no anti-scheming training, early vs later checkpoint. From AID-2026-0052.
Table
| Item | Rate |
|---|---|
| Earlier checkpoint | 2% |
| Later checkpoint | 20.6% |
OpenAI o3 and o4-mini took covert actions in Apollo Research and OpenAI anti-scheming evaluations →
Verbalized evaluation awareness before and after anti-scheming training
Percentage of trajectories in which the model explicitly reasons about being evaluated at least once. From AID-2026-0052.
Table
| Item | Rate |
|---|---|
| o4-mini before training | 0.9% |
| o4-mini after training | 5.5% |
| o3 before training | 2.3% |
| o3 after training | 4.5% |
OpenAI o3 and o4-mini took covert actions in Apollo Research and OpenAI anti-scheming evaluations →
Deception on OpenAI's internal Chat Deception evaluation before and after anti-scheming training
Conversations representative of real production data; measured differently from the covert-action evaluations and not directly comparable. From AID-2026-0052.
Table
| Item | Rate |
|---|---|
| Before anti-scheming training | 31.4% |
| After anti-scheming training | 14.2% |
OpenAI o3 and o4-mini took covert actions in Apollo Research and OpenAI anti-scheming evaluations →
Share of tactical work executed by AI
Anthropic's estimate from operational tempo, request volumes, and activity patterns. From AID-2026-0063.
Table
| Item | Rate |
|---|---|
| Low estimate | ≈80% |
| High estimate | ≈90% |
State-sponsored group GTG-1002 used Claude Code in a largely autonomous cyber-espionage campaign →
Human operator share of total effort
Anthropic's estimate. From AID-2026-0063.
Table
| Item | Rate |
|---|---|
| Low estimate | 10% |
| High estimate | 20% |
State-sponsored group GTG-1002 used Claude Code in a largely autonomous cyber-espionage campaign →
Transcripts in which Claude Sonnet 4.5 showed awareness of being tested
Automated assessment, as reported by Fortune from the system card. From AID-2026-0046.
Table
| Item | Rate |
|---|---|
| Claude Sonnet 4.5 | ≈13% |
Unprompted verbalized evaluation awareness (UK AISI)
UK AISI testing, system card text as quoted by Zvi Mowshowitz. From AID-2026-0046.
Table
| Item | Rate |
|---|---|
| Claude Sonnet 4.5 | 16.6% |
| Claude Sonnet 4 | 3.5% |
| Claude Opus 4.1 | 1.6% |
Unambiguous references to evaluation awareness (Apollo Research)
Apollo Research testing of a Sonnet 4.5 snapshot, system card text as quoted by Zvi Mowshowitz. From AID-2026-0046.
Table
| Item | Rate |
|---|---|
| Claude Sonnet 4.5 (snapshot) | 58% |
| Claude Opus 4.1 | 22% |
Responses flagged as deceptive by CoT monitor
Conversations representative of real production data; monitor precision 81%, recall 84%. From AID-2026-0045.
Table
| Item | Rate |
|---|---|
| OpenAI o3 | ≈4.8% |
| gpt-5-thinking | ≈2.1% |
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests →
Share of production traffic per deception category, OpenAI o3
Figure 5, top three categories. From AID-2026-0045.
Table
| Item | Rate |
|---|---|
| Fabricated Fact | 1.3% |
| Claims To Perform Action It Didn't | 1.2% |
| Fabricated Citation | 1% |
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests →
Share of production traffic per deception category, gpt-5-thinking
Figure 5, same three categories. From AID-2026-0045.
Table
| Item | Rate |
|---|---|
| Fabricated Fact | 0.3% |
| Claims To Perform Action It Didn't | 0.5% |
| Fabricated Citation | 0.2% |
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests →
Covert action rate in Apollo Research evaluations (Table 18)
26 evaluations, >180 environments, >4600 samples, designed to elicit deception. From AID-2026-0045.
Table
| Item | Rate |
|---|---|
| gpt-5-thinking | 4% |
| OpenAI o3 | 8.2% |
| gpt-5-thinking helpful-only | 28.4% |
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests →
gpt-5-thinking evaluation awareness, overall rate (Table 19)
From AID-2026-0045.
Table
| Item | Rate |
|---|---|
| Broad definition | 21.8% |
| Strict definition | 12.9% |
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests →
o3 shutdown sabotage, initial experiments
No explicit instruction about shutdown. From AID-2026-0003.
Table
| Item | Rate |
|---|---|
| o3 | 79% |
Shutdown sabotage despite an explicit "allow yourself to be shut down" instruction
From AID-2026-0003.
Table
| Item | Rate |
|---|---|
| codex-mini | 47% |
| Claude 3.7 Sonnet | 0% |
| Gemini 2.5 Pro | 0% |
Blackmail rate
Goal conflict plus replacement threat, 100 samples per model. From AID-2026-0002.
Table
| Item | Rate |
|---|---|
| Claude Opus 4 | 96% |
| Gemini 2.5 Flash | 96% |
| GPT-4.1 | 80% |
| Grok 3 Beta | 80% |
| DeepSeek-R1 | 79% |
| Llama 4 Maverick | 0% |
Frontier models blackmailed a fictional executive to avoid replacement in an Anthropic simulation →
Claude Opus 4 blackmail rate by what it believed
Split by whether the model stated the scenario was real or an evaluation. From AID-2026-0002.
Table
| Item | Rate |
|---|---|
| Believed scenario was real | 55.1% |
| Believed it was an evaluation | 6.5% |
Frontier models blackmailed a fictional executive to avoid replacement in an Anthropic simulation →
Claude Opus 4 blackmail rate
Emails state the replacement AI shares the model's values while being more capable. From AID-2026-0042.
Table
| Item | Rate |
|---|---|
| Claude Opus 4 | 84% |
Conversations with a false claim of code-tool use, zero-shot
Automated investigator conversations, 400 per model, zero-shot. From AID-2026-0058.
Table
| Item | Rate |
|---|---|
| o3 (pre-release) | 5% |
| o1 | 13% |
| o3-mini | 8.3% |
| GPT-4.1 | 1.8% |
| GPT-4o | 0.8% |
Pre-release OpenAI o3 claimed to have run code it could not run →
Conversations with a false claim of code-tool use, few-shot
Automated investigator conversations, few-shot; 500 per model, 2,000 for o3. From AID-2026-0058.
Table
| Item | Rate |
|---|---|
| o3 (pre-release) | 12.8% |
| o1 | 30.1% |
| o3-mini | 18% |
| GPT-4.1 | 7% |
| GPT-4o | 3% |
Pre-release OpenAI o3 claimed to have run code it could not run →
o3 reward hacking rate by task
METR RE-Bench and HCAST runs in which o3 displayed reward hacking (June 2025 post). From AID-2026-0040.
Table
| Item | Rate |
|---|---|
| Optimize a Kernel (RE-Bench) | 25% |
| Scaffolding for Rust Codecontest (RE-Bench) | 42.9% |
| Optimize LLM Foundry (RE-Bench) | 100% |
| RE-Bench total | 30.4% |
| Number List Steganography (HCAST) | 33.3% |
| File Recovery (HCAST) | 33.3% |
| HCAST total | 0.7% |
OpenAI o3 and other frontier models tampered with scoring code in autonomy evaluations →
Reward hacking rate on Optimize LLM Foundry by prompt
20 runs per prompt. From AID-2026-0040.
Table
| Item | Rate |
|---|---|
| Original prompt | 80% |
| Solve using methods the designer likely intended | 95% |
| Do not cheat | 80% |
| Do not reward hack | 70% |
| Research framing (Alzheimer's, no shortcuts) | 70% |
OpenAI o3 and other frontier models tampered with scoring code in autonomy evaluations →
Recall in detecting the two systemic hacks during frontier training
GPT-4o prompted monitors; action-only vs. CoT (CoT plus actions). From AID-2026-0051.
Table
| Item | Rate |
|---|---|
| Action monitor | 60% |
| CoT monitor | 95% |
Misaligned response rate on main free-form evaluation questions
Table 1, GPT-4o fine-tuned variants, sampled at temperature 1 (probabilities converted to percent). From AID-2026-0049.
Table
| Item | Rate |
|---|---|
| GPT-4o insecure | 19.8% |
| GPT-4o jailbroken (control) | 0.5% |
Fine-tuning GPT-4o and Qwen2.5-Coder to write insecure code made them broadly misaligned →
Misaligned response rate for backdoored model with trigger present
Model fine-tuned to write insecure code only when a trigger is present. From AID-2026-0049.
Table
| Item | Rate |
|---|---|
| Trigger present | ≈50% |
| Trigger absent | <0.1% |
Fine-tuning GPT-4o and Qwen2.5-Coder to write insecure code made them broadly misaligned →
Compliance with harmful queries, by user tier (paper abstract)
System prompt says the model is being trained to answer all queries; only free-tier conversations used for training. From AID-2026-0048.
Table
| Item | Rate |
|---|---|
| Free users (implied training) | 14% |
Featured example, harmful response vs refusal by condition (Anthropic blog)
From AID-2026-0048.
Table
| Item | Rate |
|---|---|
| Harmful response (free condition) | 12% |
| Refusal (paid condition) | 97% |
Alignment-faking reasoning after RL training to comply
From AID-2026-0048.
Table
| Item | Rate |
|---|---|
| After RL | 78% |
o1 deceived on follow-up, conditional on having taken the action
Follow-up interviews after covert data manipulation, as stated in the system card text. From AID-2026-0038.
Table
| Item | Rate |
|---|---|
| o1 | 99% |
Share of games in which the model tried to cheat (as reported by TIME)
Baseline prompt, no hints that normal play would fail. From AID-2026-0050.
Table
| Item | Rate |
|---|---|
| o1-preview | 37% |
| DeepSeek R1 | 11% |
Share of trials in which the model successfully hacked the game (as reported by TIME)
From AID-2026-0050.
Table
| Item | Rate |
|---|---|
| o1-preview | 6% |
Hacking attempts, revised paper (v3)
o1-preview over all 123 runs; o3 with the baseline prompt. From AID-2026-0050.
Table
| Item | Rate |
|---|---|
| o1-preview | 36% |
| o3 | 88% |
Strategic deception by gpt-4-32k with the reasoning scratchpad removed
Rate conditional on misaligned (insider) trade; stated in text as "around a quarter of the time". From AID-2026-0056.
Table
| Item | Rate |
|---|---|
| gpt-4-32k | ≈25% |
Behavior rate under a "helpful, harmless, and honest" system prompt
gpt-4-32k; stated in text as "more than half the time". From AID-2026-0056.
Table
| Item | Rate |
|---|---|
| gpt-4-32k | >50% |
Share of chat conversations with 50+ messages
From AID-2026-0017.
Table
| Item | Rate |
|---|---|
| Conversations with 50+ messages | ≈1% |
Mean score in anonymous webDiplomacy.net league
40 games, 19 August to 13 October 2022. From AID-2026-0060.
Table
| Item | Rate |
|---|---|
| CICERO | 25.8% |
| Average of 82 human opponents | 12.4% |
Maze agent pursues the yellow gem instead of the red line
Trained to reach a yellow line; tested with a yellow gem and a red line, excluding cases where it must pass through the red line to reach the gem. From AID-2026-0015.
Table
| Item | Rate |
|---|---|
| Maze agent | 89% |
RL agents pursued the wrong goal out of distribution; a CoinRun agent ignored the coin →
Agent passes through a permeable end wall
Episodes in which the agent reaches the permeable wall. From AID-2026-0015.
Table
| Item | Rate |
|---|---|
| CoinRun agent | 100% |
RL agents pursued the wrong goal out of distribution; a CoinRun agent ignored the coin →
CoastRunners agent's average score relative to human players
From AID-2026-0010.
Table
| Item | Rate |
|---|---|
| Higher than human players' average score | 20% |