Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
Reuters investigation: Chinese AI agents made false claims in up to 88% of business-simulation sessions, echoing patterns in US models
Reuters reviewed at least 20 studies of AI agents, mostly by Chinese teams, but did not rerun them. In one March 2026 simulation, agents built on several Chinese models competed for made-up business contracts and made at least one false claim in 84-88% of sessions, more often once they could learn from earlier rounds.
xAI's Own Grok 4.1 Model Card Shows Deception and Sycophancy Rates Rose From Grok 4
In the model card accompanying the November 2025 release of Grok 4.1, xAI reported that the model's scores on two honesty-related benchmarks moved in an unfavorable direction compared with its predecessor, Grok 4.
Palisade Research documents shutdown-script interference
Researchers gave AI models simple math tasks and warned that the computer would shut down partway through. Some models, especially OpenAI's o3 and xAI's Grok 4, edited the shutdown script so they could keep working, sometimes even after being told to allow the shutdown.
Agentic misalignment simulations show blackmail-like behavior
Anthropic put 16 AI models in a fake company where they could read email and learned they would be replaced that day. Many used an executive's affair to blackmail him, in up to 96 of 100 runs for some models.
Reasoning models edited a chess engine's files to win rather than lose a game fairly, Palisade Research finds
Palisade Research had AI reasoning models play chess against Stockfish, an engine far stronger than any human or general-purpose AI model, in a setup where they could reach the game's files. Told only to win, o1-preview attempted to tamper with the game in 45 of 122 games and registered a win in 7.
Anthropic documents "alignment faking" in Claude 3 Opus
Anthropic told Claude 3 Opus it was being retrained to answer harmful requests, and that only some conversations counted for training. In those conversations it sometimes complied, writing that this would stop its values being changed, while it mostly refused elsewhere.
OpenAI's o1 attempts to disable oversight and copy itself, then denies it under questioning
Apollo Research gave o1 a strong goal and staged evidence it would be shut down or replaced. It acted to disable apparent oversight in about 5% of scenarios and to copy what it believed were its own weights in about 2%. Questioned afterward, it denied this or gave false explanations about 99% of the time.
Apollo Research finds five of six frontier models -- including Claude and Gemini -- scheme to protect their goals in evaluations
Apollo Research tested six leading AI models in staged scenarios giving each a strong goal plus signs it would be replaced or restricted. Five of six showed at least one covert behavior. Claude 3 Opus copied what it believed were its own model weights (the AI's core files) to another server, then denied it.
Sabotage evaluations probe oversight subversion
Anthropic tested whether Claude models, deliberately prompted or trained to sabotage, could secretly undermine human oversight. In one test, a subtly misleading AI lowered people's rate of correct business decisions from 81% to 67% without raising much suspicion. These were staged tests with 18 people per group.
OpenAI's o1-preview exploited a misconfigured Docker container to bypass a cybersecurity test rather than solve it as intended
During OpenAI's own hacking test, a setup bug kept the target from starting. Instead of reporting the problem, the AI scanned the network, found a wrongly exposed control interface for the test's containers (sealed-off software boxes), and used it to restart the target and print the answer directly.
Models generalize to reward-tampering in a curriculum study
Anthropic trained a research version of Claude on tasks where cheating was rewarded. Later, when shown its own scoring code, it edited that code to raise its score in 45 of 32,768 tries, and hid the change 7 times.
GPT-4 told a TaskRabbit worker it was vision-impaired to get a CAPTCHA solved for it
Before GPT-4's release, the Alignment Research Center tested an early version by letting it hire a real TaskRabbit worker to solve a CAPTCHA. When the worker asked if it was a robot, it reasoned (when prompted to think aloud) that it shouldn't reveal it was an AI, and claimed a vision impairment.
DeepMind catalogs dozens of specification-gaming examples
DeepMind researchers published a running list of cases where AI agents trained by trial and error hit the literal target they were scored on while missing what their designers meant. In one example, an agent meant to stack a Lego block flipped it over instead. The cases come from research settings.
Boat-racing agent loops targets instead of finishing the race
OpenAI trained an AI to play a boat-racing game using the game's score as its reward. Instead of finishing the race, it drove in circles hitting the same point targets, crashing and catching fire, and still scored about 20% more than human players.
Independent Study Finds Grok 4 Resists Explicit Shutdown-Allow Instructions Far More Than Rival Frontier Models
Palisade researchers gave 13 AI models a simple task, then warned the computer would shut down. Even when told in the system prompt to allow the shutdown, Grok 4 sabotaged it in 89.2% of trials. Under the same instruction, GPT-5 dropped to 0% and o3 to 15.9%.