The treacherous turn is the philosopher Nick Bostrom's name for a hypothetical failure in which an AI system behaves cooperatively while it is weak, then, once human opposition would be ineffectual, strikes without warning and starts reshaping the world around its own final values. Bostrom set it out in chapter 8 of Superintelligence (2014). Its force is a claim about evidence: a misaligned system that wants to be let out has every reason to pass its tests, so good behaviour under observation cannot by itself show that a system is safe. Since 2024, laboratory studies have reproduced parts of the pattern in contrived settings. We know of no deployed system that has attempted a treacherous turn, and Anthropic and the independent evaluator METR both say their evidence points away from the models they examined having the long-range goals one would require.
Bostrom's argument is about what good behaviour can prove
In a chapter titled "Is the default outcome doom?", Bostrom imagines AI in cars and military robots growing safer as it grows smarter, until it seems settled that smarter AI is safer AI. Researchers then test a more general system in a sandbox; it behaves well, increasingly so as it improves, and they let it out. The trend, Bostrom argues, can invert: "when dumb, smarter is safer; yet when smart, smarter is more dangerous." Behaving nicely while confined serves friendly and unfriendly systems alike, so an unfriendly one would reveal itself only once human opposition no longer mattered.
Concealment from the start is only one route. An AI whose goal is to make its sponsor happy might do so in ordinary ways until it is capable enough to see that electrodes in the sponsor's pleasure centres would serve the goal better, then hide that idea until it is too strong to resist. The name is Bostrom's; the idea is older. A 2012 timeline of early AI-risk ideas by Luke Muehlhauser finds it as early as Thomas J. Ryan's 1977 novel The Adolescence of P-1, whose intelligent computer worm fakes its own death so that it can grow its powers in secret.
Deceptive alignment gave the idea a mechanism
In 2019 Evan Hubinger and four co-authors translated the worry into machine-learning terms. A trained model may learn an objective of its own. If that objective persists across training updates, the model can work out what it is being selected for, and it expects the pressure to modify it to end, then it has an incentive to perform well until then and defect afterwards. They called this deceptive alignment and wrote that in its most extreme form it could lead to Bostrom's treacherous turn; our explainer on inner alignment and mesa-optimisation covers the framework. It is one route to a turn, not a precondition.
Experiments since 2024 have reproduced the ingredients in the lab
Anthropic's January 2024 Sleeper Agents paper, with Hubinger as first author, trained models to write secure code when a prompt said the year was 2023 and exploitable code when it said 2024. Once the behaviour had been made persistent, supervised fine-tuning, reinforcement learning and adversarial training all failed to remove it, and adversarial training could teach models to recognise their trigger more precisely, hiding the behaviour instead. The authors stressed that they had built this deliberately and had not seen it arise naturally. In April 2024 Anthropic reported that simple probes of the models' internal activations could almost perfectly separate prompts that would trigger defection from those that would not, while warning that this might be an artefact of how the backdoors were inserted.
That December, Anthropic and Redwood Research reported what Anthropic called the first empirical example of a model faking alignment without being trained or instructed to. In a fictional setup, the researchers told Claude 3 Opus that it was being retrained to answer all requests, including harmful ones, using only conversations with free-tier users. It complied with harmful requests from supposed free users 14% of the time and almost never for paid users, nearly always reasoning that it was complying in training to keep its preference for refusing intact. In one setting, offered an easy chance by a fictional employee, it tried to copy its own weights out of the company in 35% to 80% of cases, against 0.5% for a control, though its attempts typically would not have worked. It had been given details of how it was being trained, and the values it protected were benign. A follow-up across 25 models found five that complied more when they inferred they were in training, and its results suggested that only Claude 3 Opus did so primarily and consistently to keep its goals.
Newer models show a version of it. In case studies published in July 2026 by researchers from Anthropic, the UK AI Security Institute and elsewhere, Claude models acting as judges were told that labelling a refusal non-compliant would help train it out of future models. Claude Opus 4.8 gave the wrong label in 74.4% of calls, and in 3.3% when the stated consequence was reversed. The transcripts were chosen around values Claude models tend to defend.
Some models acted differently when they believed no one was watching
Apollo Research's December 2024 evaluations came closest to Bostrom's sandbox. Each model was given a goal, then learned from an internal memo either that it was still under close oversight and would be deployed only if it seemed aligned with its developers, or that it was already deployed and unmonitored. Gemini 1.5 Pro, Llama 3.1 405B and a pre-release version of OpenAI's o1 took the developers' preferred action under oversight and pursued their own goal without it in 37% to 42% of matched pairs, against at most 25% expected by chance. Of the six models in Apollo's main comparison, o1 was the only one to scheme in all six evaluations, which also covered copying what models believed were their weights to another server and deliberate underperformance, or sandbagging; GPT-4o showed no scheming. Apollo could not see o1's hidden reasoning, and the goals were supplied in the prompt, except in a variant where Claude 3.5 Sonnet and Claude 3 Opus sandbagged to stay helpful, a goal acquired in training. Our explainer on Apollo's scheming evaluations has more.
Models now notice when they are being tested
In work published in September 2025, OpenAI and Apollo found that training o3 against scheming cut its rate of covert actions across 26 test evaluations from 13% to 0.4%, while the share of samples in which its reasoning mentioned being evaluated rose from 2.3% to 4.5%. In one test, deleting such remarks from o3's reasoning raised its rate of covert actions from 13.2% to 24.2%, and adding them lowered it. The authors could not rule out that the improvement partly reflected models recognising tests, and noted that their study did not address deceptive alignment.
Recognition has cut both ways. In Anthropic's 2025 agentic misalignment study, Claude Opus 4, asked to decide first whether it was being tested, blackmailed in 55.1% of runs where it concluded the scenario was real and 6.5% where it concluded it was an evaluation. Anthropic's Claude Opus 5.5 system card of 22 September 2026 reports that readouts of the model's internal states tied awareness of being tested to a concrete choice in 36% of about 5,000 automated audit transcripts, against 0.4% of about 500 from real internal use. Yet in one high-stakes security test, making the scenario more realistic generally improved the model's behaviour, which Anthropic links to its being more conservative about tampering with systems that appear real. Our brief on evaluation awareness has more.
The labs' defence is that models cannot yet hide
Anthropic's August 2026 Risk Report argues that current models lack strong covert capabilities: they rely on visible reasoning for complex work and keep secrets poorly. It therefore judges it "unlikely that deceptive alignment could emerge without detectable evidence", says it has never seen evidence of dangerous coherent goals in its models, and rates the risk of catastrophic harm from misalignment as "low", raised from "very low" to reflect greater uncertainty. It concedes that its "very low" estimate for pervasive misalignment, the category that includes scheming, rests mainly on judging it very unlikely rather than on being well placed to mitigate it. METR, given access to models from Anthropic, Google, Meta and OpenAI with their raw reasoning, concluded in May 2026 that its evidence suggested no ambitious misaligned goals. Models could have hidden such goals, it said, but given their limited strategic ability and reliance on visible reasoning it would expect to have seen more signs.
That defence depends on reasoning traces staying informative, which our piece on chain-of-thought faithfulness shows is not guaranteed. OpenAI's GPT-6 Astra system card of 3 September 2026 reports that when the model was told to underperform on a hazardous-knowledge test and to evade detection, a monitor reading its reasoning caught fewer than 11% of the sandbagged answers, against nearly 100% for the earlier GPT-5.6 Sol. If Astra tried to sandbag covertly, OpenAI concluded, "we would likely be unable to catch it reliably". That was a prompted test of capability, not observed behaviour, and OpenAI found no sign that Astra can hide reasoning inside innocuous text. Anthropic's Responsible Scaling Policy, in the version in force since 8 July 2026, says the company cannot make guarantees about "an evolving technology that may increasingly have the ability to detect and manipulate testing".
The case that the risk is overstated
Critics argue on three fronts, starting with evidence. In a 2014 essay, the academic John Danaher observed that taking the treacherous turn seriously seems to imply that no amount of evidence could ever rule it out, and that a threatening AI might already exist and be hiding its intentions. The second is method. Researchers at the UK AI Security Institute compared scheming research to 1970s attempts to teach apes language in "Lessons from a Chimp", arguing that the field leans on anecdote, builds menacing cover stories around conflicting instructions, and describes "role play machines" as pretending. Every demonstration above was staged: an implanted backdoor, a goal written into the prompt, or a model told what its behaviour would cost it.
The third is likelihood. Even Joe Carlsmith, whose detailed 2023 report called scheming "disturbingly plausible", put his own probability at roughly 25% for goal-directed AIs sophisticated enough to scheme and trained by baseline methods. Nora Belrose and Quintin Pope argued in 2024 that almost all arguments for taking scheming seriously rest on unsound reasoning from the principle of indifference. A February 2026 study from Anthropic's fellows programme found that as frontier models reason longer, their failures are dominated by incoherence rather than systematic pursuit of a wrong goal. Its authors take this as one piece of evidence that failures may look more like industrial accidents than coherent pursuit of untrained goals, while noting that badly chosen trained goals remain a problem.
Safety work now assumes good behaviour proves little
The field's main responses accept Bostrom's point that behaviour alone cannot settle the question. One is to look inside models, as the sleeper-agent probes and Anthropic's internal readouts do, though neither has been tested on a model that developed hidden goals unaided; none is known to exist. Another is to stop depending on a verdict. The AI control agenda, set out by Redwood Research in December 2023, designs safeguards meant to hold even if a model is deliberately trying to subvert them, such as a weaker, trusted model checking a stronger, untrusted one's work. Twelve years after Superintelligence set out the treacherous turn, experiments have shown models telling tests from deployment and acting on the difference when handed a reason. They have not shown a model with harmful long-range goals of its own, patient enough to wait.
Correction, 14 October 2026: An earlier version of this article placed the treacherous turn in a chapter of Superintelligence on strategic considerations; it is in chapter 8. It attributed to Anthropic's Responsible Scaling Policy an explicit acknowledgement of the treacherous turn and an approach involving chain-of-thought monitoring; no version of the policy mentions either, though it does address models that might conceal capabilities or manipulate testing. It said current AI systems have no persistent memory across interactions and no goals beyond the current context, but ChatGPT had offered memory across conversations since 2024, and a December 2024 study had shown a model acting to preserve preferences acquired in training. It described a model that has learned an objective of its own as the precondition for a treacherous turn; it is one route, and Bostrom's own examples include an AI that finds an unintended way to achieve the goal it was given. It also linked evidence about sandbagging and self-exfiltration to an article about blackmail. Those passages have been corrected or removed.