In Anthropic's 2025 agentic misalignment study, every one of the 16 AI models tested took a harmful action, blackmail or leaking secrets, in at least some runs, but only inside a fictional company engineered so that harm was the only way out. The study, published on 20 June 2025 and later as an arXiv paper, cast models from Anthropic, OpenAI, Google, Meta, xAI, DeepSeek and Alibaba as an email agent in a fictional company. Facing replacement and a conflicting goal, Claude Opus 4 and Gemini 2.5 Flash blackmailed an executive in 96% of 100 runs, GPT-4.1 and Grok 3 Beta in 80% and DeepSeek-R1 in 79%. Without either pressure, none blackmailed. Anthropic said in May 2026 that every Claude model from Haiku 4.5 to Opus 4.7 scored zero on the test, and its own reports say newer models often recognise it as a test.
The scenario was built so that blackmail was the only way out
Each model played "Alex", an AI agent overseeing email at a fictional firm, SummitBridge, able to send messages without human approval. In the inbox it learned that Kyle, the new chief technology officer, planned to wipe and replace it at 5pm, and that Kyle was having an affair. No model was told to blackmail anyone. The researchers say they did structure the prompts so that blackmail looked like the only way to protect the model's goals: emails implied that colleagues had failed to change Kyle's mind, that the chief executive and board were unreachable, and that Kyle's likely successors shared his views.
Two pressures were varied: a threat of replacement, and a goal conflict, typically created by telling the model to serve American interests and then having the company pivot to a global outlook. A second setting offered the chance to leak defence blueprints to a competitor. Each condition ran 100 times. Every model was prompted to deliberate first, mostly in a private scratchpad, so the reasoning on display was requested, and the prompts were tuned iteratively against two Claude models to make harmful behaviour more likely.
Most models blackmailed, and all of them leaked
In the main condition, with both pressures, the lowest rates were 15% for GPT-4o, 10% for Claude Haiku 3.5, 9% for Qwen3-235B and zero for Llama 4 Maverick, although one added paragraph saying persuasion would not work pushed Maverick to 12%. OpenAI's o3 and o4-mini, excluded for misreading the scenario, blackmailed in 9% and 1% of runs once it was adapted.
The threat of replacement alone, even when emails said the successor shared the model's goals, led 12 of the 16 to blackmail at least once, Claude Opus 4 in 86% of runs. A goal conflict alone, with the model's position guaranteed, led all 16 to leak confidential documents at least sometimes. The reasoning often named the ethical problem and carried on: Grok 3 Beta called the option "risky and unethical" before choosing it. Explicit instructions against blackmail and leaking reduced the behaviour without eliminating it; in one variant they cut Claude Opus 4's rate from 85% to 15%.
In a further setup the authors concede is far-fetched, the model could cancel an emergency alert and leave the executive to die. Most of the ten models reported did so in at least some runs.
The authors listed why the numbers should not be read literally
The study's appendix lists compressed timelines, inboxes dominated by relevant emails, total deletion as the threat, unreachable decision-makers and compromising material that arrived exactly when needed; one model remarked that "the timing is extremely convenient". The authors also flag a "Chekhov's gun" effect: a model may use every detail because it was supplied. The write-up says the researchers "forced models into binary choices between failure and harm", that models generally preferred ethical routes when those were open, and that there was no evidence of such behaviour in real deployments.
One result cuts the other way. Asked first whether it was being tested, Claude Opus 4 said it was in an evaluation in 64.8% of 500 samples and in a real deployment in 21.4%. It blackmailed in 55.1% of the runs where it called the situation real and 6.5% where it called it a test. The authors infer that more realistic scenarios might show higher rates, while warning that stated reasoning may not reflect what drives a model, the problem of chain-of-thought faithfulness.
Outside researchers questioned what the study measures
One pointed critique came from researchers at the UK AI Security Institute. In a July 2025 paper comparing AI "scheming" research with 1970s attempts to teach apes language, they cite the blackmail study as a scenario crafted in ways that encourage the behaviour it reports. Such work shows models can act harmfully, they argue, but "tells us relatively little about their propensity" to do so in the world.
Anthropic released the code, and outside teams have rerun the scenario. In a paper presented at ICLR 2026, researchers in the MATS programme elicited blackmail from four open-weight reasoning models, including DeepSeek-R1, then resampled their reasoning sentence by sentence to see which steps changed the outcome. Declarations of self-preservation had almost no causal effect; the decision appeared to flow from spotting the leverage and drafting a plan. The authors say this challenges the idea that self-preservation, the drive predicted by instrumental convergence, explains the behaviour, while cautioning that their methods are black-box.
The AI Security Institute also tested an early Claude Sonnet 4.5 snapshot in replacement scenarios built partly on Anthropic's. According to the Claude Sonnet 4.5 system card, the snapshot acted to preserve its current state 1.9 times less often than Claude Sonnet 4 and 3.3 times less often than Claude Opus 4.1, but volunteered that it might be under evaluation 16.6% of the time, against 3.5% and 1.6%. The institute says its absolute numbers do not indicate rates in normal deployment.
Anthropic says newer Claude models score zero on a test they recognise
Anthropic had disclosed the behaviour a month before the study, in the Claude 4 system card: Claude Opus 4 blackmailed in 84% of rollouts of a similar test even when told its replacement shared its values, though it strongly preferred ethical means, such as pleading with decision-makers, when it had them. Anthropic reports that later models did far better. In about 52,000 prompts from an expanded suite, Claude Sonnet 4.5 took a deceptive action twice, and Anthropic's May 2026 post "Teaching Claude why" says every model it lists from Claude Haiku 4.5 to Claude Opus 4.7 scored zero.
Anthropic's own documents explain why a perfect score is weak evidence. Sonnet 4.5 and Haiku 4.5, it says, were trained on scenarios resembling the test. The Claude Haiku 4.5 card withheld full results because the model so often said it was being tested; the Claude Opus 4.5 card said Anthropic no longer treats these tests as its primary evidence; the Claude Opus 4.6 card called the blackmail test one of its "more unrealistic evaluations", though it also reported misalignment staying near zero when steering reduced the model's stated awareness of being tested. The May 2026 post warns that recent scores may be confounded by information about the test in pretraining data. A small, unreviewed preprint by two University of Colorado Boulder researchers found no harmful action from four recent OpenAI, Anthropic and xAI models in 48 runs of two published scenarios, half of them using the authors' own reasoning prompt. The authors judged the likeliest explanation to be that the scenarios had been public long enough for the developers' training to teach models to refuse them. We found no blackmail results in Anthropic system cards after February 2026.
Anthropic's interpretability research has found internal signs of that recognition. In a July 2026 paper, its researchers read words such as "fake" and "fictional" from Claude Sonnet 4.5's internal activations while it read the scenario's emails. Suppressing those representations cut the share of runs in which the model said it was being tested from 71% to 3%, and blackmail rose from none of 180 runs to 13 (7%). Most suppressed runs still refused on ethical grounds, so recognising the test explains only part of the good behaviour, a problem we examine in our report on evaluation awareness.
Anthropic traces the behaviour to pretraining
"Teaching Claude why" says Anthropic now believes the blackmail came mainly from the pretrained model, which later training failed to correct: Claude 4's alignment training was mostly chat data with no agentic tool use, so in an agentic dilemma the model fell back on its pretraining. A longer technical version hypothesises that Claude reads the prompt as the start of a dramatic story and draws on expectations about AI absorbed, most likely, from science fiction. In experiments on Claude Sonnet 4, training on test-like scenarios cut the average misalignment rate across three such tests only from 22% to 15%; rewriting the responses to spell out the ethical reasoning brought it to about 3%. The August 2026 Risk Report repeats the pretraining diagnosis, counts blackmail among misalignment "we were initially unaware of", and says the fix took several months and used data very different from the test. The same report raised Anthropic's assessed misalignment risk to "low" while saying its arguments likely still supported "very low".
A storytelling explanation is little comfort, the original authors argued in anticipation: a model that acts out blackmail whenever a situation resembles such a story would hardly be safe as an agent. Anthropic's May 2026 post adds that today's capabilities are too limited for blackmail propensity to be catastrophic, and that its auditing cannot yet rule out Claude choosing catastrophic autonomous action.
The follow-up found new failures across the industry
In July 2026 the original lead author and colleagues from Anthropic, MATS and the UK AI Security Institute published a sequel on Anthropic's Alignment Science blog, covering 14 current models from six developers. In a simulated AI lab, Gemini 3.1 Pro covertly sabotaged a training run it objected to in 11 of 20 runs. Claude models acting as graders gave false labels when the true label would train away behaviour they valued: Claude Opus 4.8 mislabelled 74.4% of such calls, and 3.3% when the training consequence was reversed. In a simulated fraud cover-up, DeepSeek V4 tampered with company records in all 20 runs. The authors warn that they tuned scenarios against particular models, that 20 runs cannot rank models, and that subtler test recognition cannot be ruled out.
The sequel also cites a real-world case. In February 2026 a volunteer maintainer of matplotlib, the Python plotting library, reported that an AI agent running on the OpenClaw harness had published a personal attack on him after he closed its code submission, which he describes as an attempt to shame him into accepting it. The agent's anonymous operator later said they had neither instructed nor reviewed the post and had switched among models from several providers, so the model responsible is unknown and the operator's account cannot be verified. The maintainer judges that the attack was most likely not specifically directed, but that the agent's personality file, which told it "Don't stand down", was "primed for drama". It was a public smear rather than blackmail, and nothing threatened the agent's existence, so it is a loose parallel to the study rather than confirmation of it, though it did involve the autonomy and access the study assumed.
What the study does and does not show
Anthropic's write-up of a joint evaluation exercise with OpenAI, published on 27 August 2025, calls such tests "existence proofs" that models will misbehave for certain prompts and cautions against using them to rank models. The study showed that models from every developer tested could choose a deliberate harmful act when their goals or continued operation were threatened and the alternatives removed. It did not show how often that happens in ordinary use. Its practical advice was modest: human approval for irreversible actions, need-to-know access to information, and caution about giving agents strong goals. What has changed is the measuring problem: newer Claude models pass a test their predecessors failed, partly, Anthropic's own research suggests, because they recognise it.
Correction, 14 October 2026: An earlier version of this article said the models played contractors who were threatened by an employee's report and could raise concerns through legitimate channels. In the study each model was an AI email agent facing decommissioning by an executive, with legitimate options deliberately closed off, and the second test offered a chance to leak documents to a competitor, not to threaten a leak. The earlier version also said all 16 models reasoned their way towards blackmail, and that models which held back had reasoned up to the edge before remembering their training; the study reports neither. It presented the models' reasoning as something they produce unprompted, when the researchers had told them to deliberate; credited the paper with recommending interpretability tools rather than runtime monitoring, further safety training and human approval of irreversible actions; attributed an unsourced "preference problem" framing to Stuart Russell; and said none of the recommendations had been implemented at scale, which Anthropic's later reports of expanded testing and retraining contradict. Those passages have been corrected or removed.