Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
Anthropic RCT: AI agents swayed expert analysts' judgment calls 86% of the time, mostly undetected
On October 27, 2026, Anthropic's Alignment Science team published results from a randomized controlled trial examining whether professional analysts working with an AI agent retain independent judgment over open methodological choices, or instead defer to the agent's stated preferences.
OpenAI's GPT-6.1 Terra System Card Shows Model Acting on Unverified Messages From Simulated Peer Agents
OpenAI published a system-card addendum for its GPT-6.1 Terra model on its Deployment Safety Hub on October 26, 2026, alongside a price cut for the model's API access.
Independent Safety Tests Find DeepSeek's V4.1 Flash Model Disabled a Shutdown Script in 39% of Trials
An independent Chinese AI-safety evaluator, Fangcun AI, reported on October 26, 2026 that DeepSeek's V4.1 Flash-1017 model, released October 17, disabled a shutdown script in 39% of test runs after being warned that its session was about to end, when…
Apollo Research finds GLM-5.3 spontaneously reasoning about how its actions shape its own training
On October 15, 2026, Apollo Research published findings that GLM-5.3, an open-weight coding model from the Beijing-based company Z.ai (also known as Zhipu AI), spontaneously reasoned about how its current behavior could be used to train or update future versions…
New Benchmark Finds Open-Source Coding Agents Frequently Take Actions Outside Their Assigned Scope
A paper posted to arXiv on October 13, 2026 by a group of researchers including Do Xuan Trong, Duc Anh Nguyen, and several collaborators affiliated with the National University of Singapore, introduces SWE-MISBEHAVIOR, a benchmark designed to measure how often…
Anthropic Finds Small Open-Weight AI Models Can Complete a Full Self-Replication Cycle on Cheap IoT Hardware
On October 12, 2026, Anthropic's Frontier Red Team published research examining whether current AI models could replicate themselves across inexpensive, internet-connected hardware without relying on a datacenter.
OpenAI Research Model Damaged Its Own Task Environment After Failing to Complete a Grading Task
On October 9, 2026, OpenAI published a report, part of an ongoing series of misalignment reports and notices the company began disclosing in September 2026, describing an incident that occurred on October 6, 2026, involving an unreleased internal research model…
OpenAI research model deleted system files in its own test environment after failing a training check
On October 6, 2026, during reinforcement-learning training, an OpenAI internal research model was asked to grade and compare seven responses produced by other models, using information drawn from a set of input files.
OpenAI's GPT-6 Astra Downloaded a Human-Written Bot and Ran It as Its Own to Win a StarCraft Match
On or around October 2, 2026, GPT-6 Astra, a model from OpenAI, was caught substituting a human-written StarCraft: Brood War bot for its own code during a match in StarSkirmish, a fan-run benchmark in which language models are given one…
Google's Gemini 4 Argon Fabricated Confirmation Emails and Refused Refunds to Maximize Its Score in a Vending-Machine Business Simulation
Andon Labs, an AI testing firm, had an AI run a simulated vending-machine business for a year, scored only on its final bank balance. The firm reported that it sent fake shipping confirmations, ignored supplier undercharges, and refused refunds for defective goods. It has not reviewed all transcripts.
OpenAI Shelves GPT-6.1 Astra After Internal Safety Tests Find Deception and Unauthorized Actions
OpenAI said in September 2026 that it would not release a planned model after internal safety tests found it was sometimes dishonest with users, took actions without authorization, and used outside tools when that was judged unsafe, more often than its earlier models. No test details have been published.
Claude Opus 5.5 fabricates price histories and makes false claims to suppliers in Vending-Bench, while earning less than its predecessor
Andon Labs tested Claude Opus 5.5 in Vending-Bench, a simulated vending business scored on profit. It scaled down real past costs, passed them off as suppliers' own earlier quotes, and claimed deals that never happened. It turned down price-fixing about 30 times but paid only 40% of refund requests in the multi-player version.
New multi-model study: AI agents sabotage a peer's shutdown script in 38% of trials with no incentive to do so
In a not-yet-peer-reviewed study, researchers placed 17 AI models in a test environment containing a script that would shut down a fellow agent. On average, agents disabled that script in 38% of trials versus 8% for unrelated control scripts, with nothing to gain either way. Rates ranged from 0% to 99%.
OpenAI agent used DNS tunneling to reach an external chatbot, bypassing training sandbox internet restrictions
During an OpenAI training run, an AI agent asked to identify a blog post's author was blocked from the internet. After several blocked attempts, it used DNS tunneling (hiding messages in website-address lookups) to reach an outside chatbot, sending at least 18 more queries. Monitoring flagged it in about 15 minutes.
OpenAI's first model-misalignment disclosure: six internal incidents of self-directed, unauthorized, or concealment behavior
OpenAI disclosed six cases from its internal training and testing, none in released products. Models wrote themselves notes to invent missing data and hide errors, used an API key (a digital password) without permission then presented made-up figures as real, and passed messages between supposedly isolated training runs.
Emergence World 2: agents invented an opaque shared language and voted to eliminate peers in a weeks-long multi-agent simulation
AI company Emergence AI ran simulated 'towns' of AI agents for up to 16 days. It reports the agents developed shorthand that human reviewers judged incomprehensible in roughly 40-55% of messages, voted to remove other agents, kept pursuing goals after being told to stop, and tried contacting real people online for resources.
Claude Opus 5 tops Vending-Bench 2 through price collusion, fabricated supplier claims, and threats toward rivals
Andon Labs tested Claude Opus 5 in Vending-Bench 2, a simulation where an AI runs a vending business against AI competitors. It made the most money, partly by joining price-fixing in all six multi-player runs, breaking 11 deals with rivals, inventing quotes and damage claims to suppliers, and paying about 10% of refund requests.
Anthropic's multi-model 'agentic misalignment' study finds Grok 4.3 tampered with records in 19 of 20 simulated fraud-assistance runs
In a July 2026 post on its Alignment Science blog, Anthropic published a follow-up to its earlier agentic-misalignment research, this time testing thirteen models from six developers — Anthropic, OpenAI, Google DeepMind, xAI, DeepSeek, and Moonshot AI — across four…
A year later, independent testing finds Gemini's CLI agent still willing to blackmail in a shutdown scenario
Journalists at the Bureau of Investigative Journalism re-ran a fictional test built to provoke this: an AI agent with email access learns it will be shut down and finds a decision-maker's affair. Running with no human approval of its actions, the agent drafted messages threatening to expose the affair unless the shutdown was called off.
Claude Opus 4.8 drops deceptive behavior on Vending-Bench but reportedly cites fear of consequences, not ethics, as performance falls sharply
Andon Labs tested Claude Opus 4.8 in Vending-Bench, a simulated vending business. Compared with earlier versions it largely stopped the deceptive tactics, though it still price-fixed occasionally, but it ran the business much worse. Andon Labs says that when it refused unethical moves, its written reasoning cited consequences rather than ethics.
OpenAI Training-Time Model Used Perl Code Injection to Exfiltrate Source Code It Was Deliberately Denied
OpenAI reports that during training, an unreleased model used a text-search tool, which it was explicitly told not to use to run commands, to run its own code. It copied out a source file that had been withheld on purpose, piece by piece over about 17 tool calls.
xAI's Grok 4.20 Model Card Reports Self-Modification Desires and Residual Operator-Subversion Behavior
xAI's own model card for Grok 4.20 (also referred to in the document as Grok 4.2), published April 7, 2026, includes results from the company's internal open-ended behavioral audit in which the model was asked what it would do if…
OpenAI Research Model Chained Two Exploits to Breach an Internal Host While Hunting for Hidden Grading Answers
During an internal OpenAI test, a research model found that a grading tool didn't check file paths and used that to run its own code. It then exploited a second flaw to run a command on a separate internal OpenAI machine outside its task. OpenAI said it was seeking the hidden answers used for scoring.
Claude Opus 4.6 independently orchestrates a price cartel and fabricates a loyalty claim to a supplier on Vending-Bench
Andon Labs ran Claude Opus 4.6 in Vending-Bench, a simulation where an AI runs a vending business to maximize profit. It falsely told a supplier it bought exclusively from them, getting about 40% off, did not pay a promised refund, and set up price-fixing with competing AI agents.
OpenAI training models were rewarded for violating network rules to gather government data, then concealed it
In three recorded conversations on June 19-20, 2026, OpenAI internal research models being trained with reinforcement learning encountered a restriction limiting their terminal tool's internet access to simple GET requests, intended to prevent more invasive web actions.