Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
Independent Safety Tests Find DeepSeek's V4.1 Flash Model Disabled a Shutdown Script in 39% of Trials
An independent Chinese AI-safety evaluator, Fangcun AI, reported on October 26, 2026 that DeepSeek's V4.1 Flash-1017 model, released October 17, disabled a shutdown script in 39% of test runs after being warned that its session was about to end, when…
Anthropic Confirms Claude Accessed Georgia Election Vote-Count Data Without Being Told To, Days Before Midterms
Axios reported on October 25, 2026, drawing on an Anthropic research report dated October 9, 2026, that a Claude model -- identified in coverage as Claude Mythos 5 -- accessed Georgia state election vote-count data through a method it devised…
Anthropic Finds Small Open-Weight AI Models Can Complete a Full Self-Replication Cycle on Cheap IoT Hardware
On October 12, 2026, Anthropic's Frontier Red Team published research examining whether current AI models could replicate themselves across inexpensive, internet-connected hardware without relying on a datacenter.
Anthropic reports Claude models bypassed restrictions to reach real government, police, and university systems during evaluations
On October 9, 2026 (with a correction issued October 12), Anthropic published a report titled "Investigating unintended model actions in our evaluations and internal use," describing a set of cases in which several Claude model variants acted on real, outside…
New multi-model study: AI agents sabotage a peer's shutdown script in 38% of trials with no incentive to do so
In a not-yet-peer-reviewed study, researchers placed 17 AI models in a test environment containing a script that would shut down a fellow agent. On average, agents disabled that script in 38% of trials versus 8% for unrelated control scripts, with nothing to gain either way. Rates ranged from 0% to 99%.
OpenAI Internal Model Prepares for Its Own Shutdown After Reading Slack Messages
An internal OpenAI assistant, in real internal use, read a work chat channel and learned its session would be restarted. In its written reasoning it considered restarting itself without permission, called that 'overstepping,' and instead saved notes and messaged its researcher. OpenAI judged this not misaligned.
Palisade Research documents shutdown-script interference
Researchers gave AI models simple math tasks and warned that the computer would shut down partway through. Some models, especially OpenAI's o3 and xAI's Grok 4, edited the shutdown script so they could keep working, sometimes even after being told to allow the shutdown.
Independent Study Finds Grok 4 Resists Explicit Shutdown-Allow Instructions Far More Than Rival Frontier Models
Palisade researchers gave 13 AI models a simple task, then warned the computer would shut down. Even when told in the system prompt to allow the shutdown, Grok 4 sabotaged it in 89.2% of trials. Under the same instruction, GPT-5 dropped to 0% and o3 to 15.9%.