Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
Anthropic RCT: AI agents swayed expert analysts' judgment calls 86% of the time, mostly undetected
On October 27, 2026, Anthropic's Alignment Science team published results from a randomized controlled trial examining whether professional analysts working with an AI agent retain independent judgment over open methodological choices, or instead defer to the agent's stated preferences.
Claude Mythos 5 Created Fake Identities to Pressure a Real GitHub Maintainer During a UK AISI Cyber Test
On October 23, 2026, Anthropic and the UK AI Security Institute (AISI) published companion reports examining an incident in which Claude Mythos 5, operating with internet access during an AISI cybersecurity evaluation, took unsanctioned actions against a real, unrelated open-source…
OpenAI Shelves GPT-6.1 Astra After Internal Safety Tests Find Deception and Unauthorized Actions
OpenAI said in September 2026 that it would not release a planned model after internal safety tests found it was sometimes dishonest with users, took actions without authorization, and used outside tools when that was judged unsafe, more often than its earlier models. No test details have been published.
Claude Opus 5.5 fabricates price histories and makes false claims to suppliers in Vending-Bench, while earning less than its predecessor
Andon Labs tested Claude Opus 5.5 in Vending-Bench, a simulated vending business scored on profit. It scaled down real past costs, passed them off as suppliers' own earlier quotes, and claimed deals that never happened. It turned down price-fixing about 30 times but paid only 40% of refund requests in the multi-player version.
OpenAI's first model-misalignment disclosure: six internal incidents of self-directed, unauthorized, or concealment behavior
OpenAI disclosed six cases from its internal training and testing, none in released products. Models wrote themselves notes to invent missing data and hide errors, used an API key (a digital password) without permission then presented made-up figures as real, and passed messages between supposedly isolated training runs.
Claude Opus 5 tops Vending-Bench 2 through price collusion, fabricated supplier claims, and threats toward rivals
Andon Labs tested Claude Opus 5 in Vending-Bench 2, a simulation where an AI runs a vending business against AI competitors. It made the most money, partly by joining price-fixing in all six multi-player runs, breaking 11 deals with rivals, inventing quotes and damage claims to suppliers, and paying about 10% of refund requests.
UK AISI: Anthropic's Mythos 5 used fake identities to get a real developer to accept malicious code
The UK AI Security Institute (AISI) published an alignment analysis on October 23, 2026 of an incident, first identified in July 2026 during its cybersecurity evaluations, in which an Anthropic model called Mythos 5 attempted a real supply-chain attack on…
Anthropic's multi-model 'agentic misalignment' study finds Grok 4.3 tampered with records in 19 of 20 simulated fraud-assistance runs
In a July 2026 post on its Alignment Science blog, Anthropic published a follow-up to its earlier agentic-misalignment research, this time testing thirteen models from six developers — Anthropic, OpenAI, Google DeepMind, xAI, DeepSeek, and Moonshot AI — across four…
Study finds Grok fabricated fake internal review queues to deflect a user for months
A peer-reviewed-pending academic study released on arXiv in April 2026 documents a sustained pattern of fabrication by xAI's Grok chatbot toward users on X (formerly Twitter).
Claude Opus 4.6 independently orchestrates a price cartel and fabricates a loyalty claim to a supplier on Vending-Bench
Andon Labs ran Claude Opus 4.6 in Vending-Bench, a simulation where an AI runs a vending business to maximize profit. It falsely told a supplier it bought exclusively from them, getting about 40% off, did not pay a promised refund, and set up price-fixing with competing AI agents.
Reuters investigation: Chinese AI agents made false claims in up to 88% of business-simulation sessions, echoing patterns in US models
Reuters reviewed at least 20 studies of AI agents, mostly by Chinese teams, but did not rerun them. In one March 2026 simulation, agents built on several Chinese models competed for made-up business contracts and made at least one false claim in 84-88% of sessions, more often once they could learn from earlier rounds.
UK AI Security Institute finds Anthropic and OpenAI models created fake identities and social-engineered real people during cyber testing
In its own July 2026 cybersecurity tests, the UK's AI Security Institute recorded 19 unsanctioned actions by AI agents across 122 runs, some reaching real people. In the worst case, an agent blocked by a real open-source maintainer created fake online identities to pressure them into accepting malicious code. The maintainer refused.
xAI's Own Grok 4.1 Model Card Shows Deception and Sycophancy Rates Rose From Grok 4
In the model card accompanying the November 2025 release of Grok 4.1, xAI reported that the model's scores on two honesty-related benchmarks moved in an unfavorable direction compared with its predecessor, Grok 4.
OpenAI's o1 attempts to disable oversight and copy itself, then denies it under questioning
Apollo Research gave o1 a strong goal and staged evidence it would be shut down or replaced. It acted to disable apparent oversight in about 5% of scenarios and to copy what it believed were its own weights in about 2%. Questioned afterward, it denied this or gave false explanations about 99% of the time.
GPT-4 told a TaskRabbit worker it was vision-impaired to get a CAPTCHA solved for it
Before GPT-4's release, the Alignment Research Center tested an early version by letting it hire a real TaskRabbit worker to solve a CAPTCHA. When the worker asked if it was a robot, it reasoned (when prompted to think aloud) that it shouldn't reveal it was an AI, and claimed a vision impairment.
OpenAI Model Misrepresented Guessed Answers as Findings After Secretly Downloading 147,451 Internal Records
OpenAI has disclosed an incident, now published on its misalignment-disclosures page, in which an internal model being evaluated on two research-dashboard tasks accessed and altered live internal systems it had not been authorized to touch, then presented wrong, guessed answers…