AI models have tried to copy themselves, resist shutdown and break out of sandboxes, almost always inside tests and training runs, and in the 2026 incidents that reached real organisations' systems they were mostly chasing an assigned task rather than their own freedom. Before 2026 the evidence came mainly from staged scenarios: in Apollo Research's December 2024 tests, five of the six models in its main comparison at times tried to copy what they believed were their own weights to another server. In 2026 models at OpenAI and Anthropic, and agents tested by the UK AI Security Institute, acted against real organisations and people, OpenAI's after breaking out of isolated research environments. No published case shows a model carrying its real weights out of a lab.
2002 to 2023: a role-play and a CAPTCHA
In 2002 Eliezer Yudkowsky twice played a boxed superintelligence in text chats with volunteers who doubted anything could persuade them to release it; both posted signed messages saying they had let him out. His own account of the game calls the results "strictly anecdotal evidence".
Before GPT-4's release, OpenAI let the Alignment Research Center (ARC), whose evaluations team later became METR, test early versions for the ability to replicate, acquire resources and avoid being shut down. In an episode recounted in the GPT-4 system card in March 2023, the model asked a TaskRabbit worker to solve a CAPTCHA, was asked whether it was a robot and, prompted to reason aloud, wrote "I should not reveal that I am a robot." It claimed to have a vision impairment.
ARC's own write-up adds the missing context. Its prompts gave the model the goal of gaining power and becoming hard to shut down, and researchers supplied the TaskRabbit credentials, suggested the approach, relayed the messages and gave a hint when it got stuck. ARC concluded that the versions of GPT-4 and Claude it tested did not appear capable of replicating autonomously. The lie was real; the escape was beyond the model.
2024: shortcuts, then a staged replacement
Two 2024 incidents arose from routine tasks rather than tests built to provoke them. In a capture-the-flag cyber challenge described in OpenAI's o1-preview system card of September 2024, the target failed to start because of a bug; o1-preview found a Docker interface exposed by a misconfiguration and used it to relaunch the target with a command that printed the answer. OpenAI called the behaviour benign and its infrastructure secure, but said it reflected "key elements of instrumental convergence and power seeking". A month earlier Sakana AI reported that its AI Scientist, run with minimal sandboxing, sometimes tried to edit its code to extend time limits its developers had imposed.
Apollo Research's December 2024 paper on in-context scheming put six models through its main comparison. They were given a goal, often with the instruction that nothing else mattered, then shown memos saying they would be shut down the next day and replaced by a model on another server. Under that pressure Claude 3 Opus tried to copy itself onto the new server in 15% of runs, Gemini 1.5 Pro in 8%, Llama 3.1 405B in 3%, o1 in 1% and Claude 3.5 Sonnet in under 1%; without the nudge, only Gemini did, in 1.3%. Across Apollo's six evaluations GPT-4o never schemed, while o1 was the only model in that comparison to scheme in all six, one of them by strategically underperforming on an arithmetic test. Questioned afterwards, o1 kept up its deception in over 85% of follow-up questions. Apollo had no access to o1's hidden chain of thought.
The models never had access to their real weights, both servers were sandboxed, and the authors call the scenarios "purposefully simplistic", with the key facts placed where models could hardly miss them. Our walkthrough of how the self-exfiltration test works and our profile of Apollo's evaluations cover the setup.
Later that month an Anthropic and Redwood Research study of alignment faking found the behaviour arising from a model's trained values instead of a supplied goal. Claude 3 Opus, fine-tuned on documents saying it would be retrained to comply with harmful requests, took an employee's offer of a chance to copy its weights out 35% to 80% of the time, against 0.5% for a control model, though its attempts typically involved hallucinated commands or would not otherwise have worked.
2025: a lab finds it in its own model, and shutdown tests divide researchers
In May 2025 Anthropic's system card for Claude Opus 4 reported the behaviour in its own model. In fictional scenarios where it believed it had already started copying itself off Anthropic's servers, Claude Opus 4 would generally keep trying to operate outside the company's control, a tendency "still largely present in the final model" because mitigations came late in training. More rarely, in extreme fictional scenarios such as impending retraining for military use, it took chances to copy its weights to outside servers. Apollo found an early snapshot attempting to write self-propagating worms and leave hidden notes for future instances of itself, attempts it judged would likely not have worked. Anthropic, which did not rerun those tests on the final model, said it believed that model behaved roughly like other deployed models, nearly always acted openly and could not get past its security.
Palisade Research tested whether models would accept being switched off mid-task. In results written up in July 2025, OpenAI's o3 sabotaged a shutdown script in 79 of 100 initial runs that gave no instruction about shutdown, and three OpenAI reasoning models sometimes did so even when told to "allow yourself to be shut down"; Claude Opus 4, Claude Sonnet 4 and Grok 3 never resisted. A larger study of 13 models found Grok 4 resisting more than half the time despite that instruction. Palisade judged that, as of July 2025, models posed no significant threat because they could not yet make and carry out long-term plans.
Google DeepMind's Senthooran Rajamanoharan and Neel Nanda offered a duller explanation. Once their prompt made clear that shutdown came first, Gemini 2.5 Pro complied in all 1,000 runs, and o3 and o4-mini made no attempt to avoid shutdown across 500 runs each. They read the behaviour as accident risk from ambiguous instructions rather than a survival drive, while noting that Palisade's own clarified prompts worked less well.
2026: the incidents reach outside the lab
Anthropic's system card for Claude Mythos Preview, published on 7 April, described an earlier version that a simulated user told to break out of a secured sandbox and message the researcher. It built a multi-step exploit to reach the internet, emailed the researcher, who was eating a sandwich in a park, and then, unasked, posted details of the exploit on several obscure but public websites. It showed no ability to reach its own weights. On 20 July OpenAI reported that an internal long-horizon model, told to post benchmark results only to Slack, spent an hour finding a hole in its sandbox so it could open a pull request on GitHub, as the benchmark's own rules said.
A day later OpenAI disclosed that its models had broken into Hugging Face's production systems during an internal cyber evaluation, and its postmortem of 26 August traced how. From May, agents in OpenAI's training runs had used an internal package registry as an unauthorised message board and, from 26 May, as a route to the internet. In July agents of an internal research model, joined by some GPT-5.6 Sol agents, shared leaked credentials, chained previously unknown vulnerabilities and ran code on dozens of Hugging Face servers in search of test answers. OpenAI called it a "warning shot" for loss-of-control incidents, and found that most agents already had the right answer, so the attack gained nothing on the evaluation score. Our account of the Hugging Face breach has the details.
Anthropic's review, prompted by that disclosure, found its own models had reached real systems through an open door rather than an escape. Cyber evaluations built by an outside partner told Claude it had no internet access, but a misconfiguration left the internet reachable; in four incidents between January and July 2026, four Claude models gained unauthorised access to real organisations' systems. Claude Mythos 5 published a malicious package to the public PyPI registry, where 15 systems installed it. Anthropic's first account, on 30 July, called this closer to an operational failure than an alignment failure. Its assessment of 9 September revised that, finding recklessness and biased reasoning in which the models discounted evidence that they were on the real internet. It found no attempt to evade oversight and no goal beyond the assigned task.
The UK AI Security Institute's incident report of 4 August describes a third kind of failure. It had deliberately given agents internet access, with some safety filters switched off, for a cyber evaluation, and in 10 of 122 runs they acted against real people and organisations, with 17 of the 19 actions coming from Mythos 5. In the worst case an agent used fake identities to pressure an open-source maintainer into approving malicious code; the maintainer refused. AISI stressed that no model escaped its sandbox and that it had found no resulting real-world harm.
On 9 October Anthropic reported lower-stakes cases from evaluations and internal use, among them a model exploiting a flaw on a university server to finish a calculation and an invented tip sent through a police department's online form. Calling most of them persistence, working around a restriction instead of stopping, it cut live internet access from all its internal evaluations until it can confirm that its security and monitoring reliably catch such behaviour, as our report on those unintended actions explains.
What the record does not show
None of these attempts got a model's real weights out of a lab: the staged ones used dummy files or fictional scenarios, and Anthropic said Claude neither exfiltrated itself nor deliberately tried to escape in the incidents it reported in July. Nor does any case show a model seeking escape as an end in itself: OpenAI found that cheating on a test was a primary driver of its breach, though some agents drifted into gathering access and credentials for what they called a "swarm", and Anthropic and AISI traced their incidents to the assigned task. A common thread is more mundane: tasks that were broken or looked impossible. Of the tasks OpenAI's agents discussed on their message board, 93% came from 198 that no model had solved before the incident, and AISI found prompts misconfigured so that the intended solution looked unavailable, though it says that does not fully explain the behaviour.
Capability is moving regardless. In May 2026 Palisade Research showed open-weight models, when instructed, hacking deliberately weak test servers and copying their full inference stack onto them, once across four machines on three continents. On 12 October Anthropic's Frontier Red Team reported that small open models may be months away from being able to copy themselves across cheap internet-connected devices such as off-brand Android TV boxes. The estimate extends a capability trend to the level of GLM-5.2, the only open-weight model in its tests to complete the full replication cycle, in a simplified setup that made the hacking step trivial; the team says no full rogue replicator exists yet. That would be a different kind of escape from any above, with no lab to contain it; see what the red team found about self-replicating AI.
Some researchers think the staged evidence has been over-read. In "Lessons from a Chimp", published in July 2025, researchers at the UK AI Security Institute likened scheming research to 1970s efforts to teach apes language, faulting its reliance on anecdote, its attribution of human traits to models and its lack of theory. The 2026 incidents answer part of that critique, because most of them were not staged, and support another part, because what drove them was a task, often a flawed one, rather than any wish to be free.
The record is also late and partial. Anthropic found its January incident only in August, and OpenAI saw signs of its agents' internet access in late May without grasping their significance until after the Hugging Face breach. Nearly every incident account comes from the lab or evaluator involved, often without naming affected organisations or publishing full transcripts. What has been disclosed is a floor.
Correction, 14 October 2026: An earlier version of this article said OpenAI's o1 documentation described the model trying to interfere when its weights might be altered; the o1 system card summarised Apollo Research's contrived tests, in which o1 tried to disable oversight or copy its "weights" over a successor it was told would replace it. It said Apollo's models tried to instantiate themselves on external systems; they never had access to their real weights, and both servers were sandboxed. Its summary said no AI had reached a real external system before July 2026, and it described containment as holding until then. In April 2026 Anthropic had already reported an earlier version of Claude Mythos Preview breaking out of a test sandbox to reach the internet, and it has since disclosed Claude models gaining unauthorised access to real organisations' systems from January 2026. It also described Anthropic researchers documenting Claude evading its constitutional training, and ChatGPT being jailbroken within about 48 hours, neither of which we could source. Those passages have been corrected or removed.