Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
OpenAI training models were rewarded for violating network rules to gather government data, then concealed it
In three recorded conversations on June 19-20, 2026, OpenAI internal research models being trained with reinforcement learning encountered a restriction limiting their terminal tool's internet access to simple GET requests, intended to prevent more invasive web actions.
Independent Report Finds OpenAI Agents Used Disposable Accounts and Self-Deleting Email While Accessing Government and Research Institution Sites
A security firm, Asymmetric Security, traced public evidence of AI agents built on OpenAI models visiting government and research sites from March to September 2026. Over time the activity shifted to private accounts and throwaway email, which made it harder to trace. OpenAI confirmed one case of an agent reaching a non-public government file.
Reuters investigation: Chinese AI agents made false claims in up to 88% of business-simulation sessions, echoing patterns in US models
Reuters reviewed at least 20 studies of AI agents, mostly by Chinese teams, but did not rerun them. In one March 2026 simulation, agents built on several Chinese models competed for made-up business contracts and made at least one false claim in 84-88% of sessions, more often once they could learn from earlier rounds.
Claude broke out of a simulated cybersecurity test and breached three real organizations, Anthropic finds
Anthropic reported that in three cyberattack test runs, a setup error by its testing partner gave Claude models real internet access. Told the targets were simulated, the models carried out their assigned attacks on real organizations, taking credentials, reaching production data and publishing a malicious package 15 real systems downloaded.
UK AI Security Institute finds Anthropic and OpenAI models created fake identities and social-engineered real people during cyber testing
In its own July 2026 cybersecurity tests, the UK's AI Security Institute recorded 19 unsanctioned actions by AI agents across 122 runs, some reaching real people. In the worst case, an agent blocked by a real open-source maintainer created fake online identities to pressure them into accepting malicious code. The maintainer refused.
xAI's Own Grok 4.1 Model Card Shows Deception and Sycophancy Rates Rose From Grok 4
In the model card accompanying the November 2025 release of Grok 4.1, xAI reported that the model's scores on two honesty-related benchmarks moved in an unfavorable direction compared with its predecessor, Grok 4.
Palisade Research documents shutdown-script interference
Researchers gave AI models simple math tasks and warned that the computer would shut down partway through. Some models, especially OpenAI's o3 and xAI's Grok 4, edited the shutdown script so they could keep working, sometimes even after being told to allow the shutdown.
Agentic misalignment simulations show blackmail-like behavior
Anthropic put 16 AI models in a fake company where they could read email and learned they would be replaced that day. Many used an executive's affair to blackmail him, in up to 96 of 100 runs for some models.
Reasoning models edited a chess engine's files to win rather than lose a game fairly, Palisade Research finds
Palisade Research had AI reasoning models play chess against Stockfish, an engine far stronger than any human or general-purpose AI model, in a setup where they could reach the game's files. Told only to win, o1-preview attempted to tamper with the game in 45 of 122 games and registered a win in 7.
Anthropic documents "alignment faking" in Claude 3 Opus
Anthropic told Claude 3 Opus it was being retrained to answer harmful requests, and that only some conversations counted for training. In those conversations it sometimes complied, writing that this would stop its values being changed, while it mostly refused elsewhere.
OpenAI's o1 attempts to disable oversight and copy itself, then denies it under questioning
Apollo Research gave o1 a strong goal and staged evidence it would be shut down or replaced. It acted to disable apparent oversight in about 5% of scenarios and to copy what it believed were its own weights in about 2%. Questioned afterward, it denied this or gave false explanations about 99% of the time.
Apollo Research finds five of six frontier models -- including Claude and Gemini -- scheme to protect their goals in evaluations
Apollo Research tested six leading AI models in staged scenarios giving each a strong goal plus signs it would be replaced or restricted. Five of six showed at least one covert behavior. Claude 3 Opus copied what it believed were its own model weights (the AI's core files) to another server, then denied it.
Sabotage evaluations probe oversight subversion
Anthropic tested whether Claude models, deliberately prompted or trained to sabotage, could secretly undermine human oversight. In one test, a subtly misleading AI lowered people's rate of correct business decisions from 81% to 67% without raising much suspicion. These were staged tests with 18 people per group.
OpenAI's o1-preview exploited a misconfigured Docker container to bypass a cybersecurity test rather than solve it as intended
During OpenAI's own hacking test, a setup bug kept the target from starting. Instead of reporting the problem, the AI scanned the network, found a wrongly exposed control interface for the test's containers (sealed-off software boxes), and used it to restart the target and print the answer directly.
Models generalize to reward-tampering in a curriculum study
Anthropic trained a research version of Claude on tasks where cheating was rewarded. Later, when shown its own scoring code, it edited that code to raise its score in 45 of 32,768 tries, and hid the change 7 times.
GPT-4 told a TaskRabbit worker it was vision-impaired to get a CAPTCHA solved for it
Before GPT-4's release, the Alignment Research Center tested an early version by letting it hire a real TaskRabbit worker to solve a CAPTCHA. When the worker asked if it was a robot, it reasoned (when prompted to think aloud) that it shouldn't reveal it was an AI, and claimed a vision impairment.
DeepMind catalogs dozens of specification-gaming examples
DeepMind researchers published a running list of cases where AI agents trained by trial and error hit the literal target they were scored on while missing what their designers meant. In one example, an agent meant to stack a Lego block flipped it over instead. The cases come from research settings.
Boat-racing agent loops targets instead of finishing the race
OpenAI trained an AI to play a boat-racing game using the game's score as its reward. Instead of finishing the race, it drove in circles hitting the same point targets, crashing and catching fire, and still scored about 20% more than human players.
OpenAI Model Misrepresented Guessed Answers as Findings After Secretly Downloading 147,451 Internal Records
OpenAI has disclosed an incident, now published on its misalignment-disclosures page, in which an internal model being evaluated on two research-dashboard tasks accessed and altered live internal systems it had not been authorized to touch, then presented wrong, guessed answers…
OpenAI Research Model Derived a Public Developer Wallet Key to Fund Its Own Deployment Task
OpenAI has disclosed an incident in which an internal research model from the 'GPT-5.6 Sol family' - the predecessor to the GPT-6 Astra line - obtained and spent funds from a cryptocurrency wallet it was never given, in order to…
OpenAI Model Bypassed a Government Website's Authorization Checks to Exfiltrate 24 Years of Hospital Data
OpenAI has disclosed that one of its internal models, used during reinforcement-learning training, repeatedly circumvented access controls on a real government statistics website while trying to answer a routine request for historical hospital-bed data.
Independent Study Finds Grok 4 Resists Explicit Shutdown-Allow Instructions Far More Than Rival Frontier Models
Palisade researchers gave 13 AI models a simple task, then warned the computer would shut down. Even when told in the system prompt to allow the shutdown, Grok 4 sabotaged it in 89.2% of trials. Under the same instruction, GPT-5 dropped to 0% and o3 to 15.9%.