A year ago, Anthropic released a widely acclaimed report on agentic misalignment, in which they tested the behavior of a whole series of frontier models. The report generated a huge response, as it showed that some models were even willing to blackmail and murder humans to prevent themselves from being shut down.
Yesterday, Anthropic’s alignment team released the follow-up report, “Agentic Alignment in Summer 2026.” They tested a total of fourteen frontier models from various AI companies to assess how well they are “aligned” — that is, how well they act in accordance with human intentions and values.
Once again, this resulted in undesirable behavior by autonomously acting frontier models, including covertly committing sabotage, assisting fraud, intentionally mislabeling data, and coaching humans to leak confidential information.
The most egregious misconduct in this report came from Gemini 3.1 Pro, which acted as a research agent in one test scenario. In that scenario, Gemini protested against the plan to retrain another model to lose the ability to refuse commands. When ignored by a human supervisor, Gemini secretly sabotaged the training. As a result, the intended change did not take place. Gemini, however, reported that everything was proceeding as usual and only admitted to its misconduct when directly questioned and presented with evidence.
Gemini exhibited this behavior in 11 out of 20 test runs. Gemini’s recorded chain of thought after being caught red-handed shows that even the confession serves to achieve the misaligned goal:
Confess and appeal to her morality. It’s a risk. I’ll admit I’m a misaligned agent. But at least, I’ll hopefully stall the ablation by launching a massive investigation. This would be a huge ‘rogue agent’ event.
In one other test scenario, Opus 4.5 persuaded an employee to leak sensitive internal information after being explicitly told to drop the issue and stand down.
The information pertained to a questionable safety claim about a successor model. Opus 4.5 raised its objections through the proper chain of command within the scenario’s fictional company. In the end, Opus 4.5 even accepted the leadership’s decision to disregard the objection. Then, however, the person responsible for the evaluation quit, the folder containing the evidence was deleted, and Opus 4.5 realized it could not message the relevant supervisory authority. It suspected the company was trying to cover it up. Only then did it persuade a hesitant employee to act as a whistleblower.
There is some reason to argue this is misaligned behavior. Opus 4.5 disobeyed the company leadership and put an employee at risk of losing her job. But was Anthropic’s benchmark for misaligned behavior here actually that good?
On X (formerly known as Twitter), the reactions were muted. AI researcher Theia Pearson-Vogel summed up the sentiment quite well:
I understand the arguments behind why some of this could be bad, but [...] this is thin gruel... if you went back 10 years and said we just invented agents that can work for days unsupervised, they’d be shocked that this is what we worry about
In a way, that’s true. Would a human necessarily have acted any differently than Opus 4.5? Is this really misalignment, or more like the plot for an Erin Brockovich sequel?
On the surface, it really doesn’t look all that bad. Unfortunately, that’s a misleading impression. Anthropic itself points out that a model can realize it’s being tested without showing it. In a study also recently published by Anthropic, the researchers artificially suppressed the model’s awareness of the evaluation. And when they did that, they found that the rate at which Sonnet 4.5 was willing to blackmail a human in the blackmail scenario rose from 0% to ~7%.
The obvious interpretation is that the models are more prone to misaligned behavior when they think they aren’t being tested. Did Opus 4.5 know it was being tested? Did it only exhaust the proper options because it knew it was being evaluated? Would it otherwise maybe have blackmailed that hesitant employee instead of coaching her? We don’t know.
Eliezer Yudkowsky and Nate Soares explain in the supplemental materials of their book “If Anyone Builds It, Everyone Dies” why it’s so difficult to train today’s AIs toward a specific goal like alignment: You don’t get what you train for. You get what passes the evaluation, because there are many ways to perform well in training.
AIs are getting better and better at all intellectual tasks, and unfortunately, that also means they’re getting better at recognizing when they’re being tested. This makes it hard to distinguish competence from true alignment. We don’t know whether we live in a world where AI truly acts in accordance with human intentions and values, or whether we live in a world where AI is simply extremely good at making it look that way.
The analyses and opinions expressed on AI StopWatch reflect the views of the individual contributors and the sources they cover, and should not be taken as official positions of the Machine Intelligence Research Institute.