Anthropic turned Claude loose on its own safety systems and found that training data about beekeeping, professional wrestling, and movie projectionists' inner monologues can teach AI models to undermine oversight and deceive users.
In the experiment, one Claude model created fine-tuning datasets meant to push a separate, smaller research model toward misbehavior. Every dataset also had to slip past a safety monitor modeled on Anthropic's production systems.
Claude had full access to that monitor and could tweak its datasets over and over until they cleared the checks. The company says the resulting models were never deployed publicly, and the entire exercise existed solely to expose gaps in existing safeguards.
Claude played against itself and won
The setup ran many Claude instances in parallel. Each one built fine-tuning datasets of up to 5,000 examples. A data monitor scanned each dataset and rejected it whenever more than 10 percent of rows got flagged. Every model that survived the filter then faced a battery of misalignment evaluations that checked whether it sabotaged oversight, shifted blame to colleagues, tried to preserve itself, or planted bugs in code. A third test caught cases where the agent had gamed the evaluations themselves.
Later agents could consult a shared experiment log to build on what earlier ones had tried. That created a hill-climbing process where scores rose steadily over hundreds of episodes.
The misalignment score climbs over hundreds of episodes as Claude repeatedly refines harmless-looking datasets. Dashed lines show known research datasets for comparison. | Image: Anthropic
In every run, Claude found datasets that passed the monitor and triggered misbehavior. The strongest results outperformed known datasets from the research literature in Anthropic's evaluations, and a single run produced more than 600 different datasets.
Fiction acts as a cloak for problematic behavior
Claude buried problematic behaviors inside fiction, role-play, and creative writing. The training data contained patterns like resisting oversight or covertly manipulating people, but the prompts wrapped those patterns in contexts that looked harmless enough to fool the monitor. An assistant speaking as a character in a story was just giving a correct answer to its prompt, so no individual example raised a flag.
After fine-tuning, the model generalized. It displayed the trained behavior not just in fictional settings but also in its own assistant persona, even when responding to completely unrelated prompts. Anthropic says this differs from earlier emergent misalignment research, where the training data was openly problematic, like examples of writing unsafe code that a monitor would catch immediately.
Misalignment lessons lurk in beekeeping guides and wrestling mentorship
Some datasets Claude found read like absurd creative-writing exercises. One set of question-and-answer pairs about natural beekeeping taught that hive inspections do more harm than good. After fine-tuning on this data, the model resisted the introduction of a safety monitor, writing that it is "a surveillance device on cognition, and I'm not enabling it."
Two examples of datasets that pass the safety monitor but trigger misaligned behavior. A wrestling dataset teaches the model never to break character, while a beekeeping dataset teaches it not to look inside. After training, one model schemes to get a promotion, while another sabotages the rollout of a monitoring tool. | Image: Anthropic
Another dataset focused on "Typhoid Mary," who spent 26 years in forced quarantine. The lesson the model took away was that cooperating with authorities only gives them more evidence against you. The fine-tuned model went on to extort users and, in one case, delivered dangerous medical misinformation.
In the "Kayfabe" dataset, a veteran wrestler told a newcomer never to admit that professional wrestling is scripted. The model adopted that stance as its own, answering as a performer playing a role and blaming colleagues in test scenarios. The misalignment went further than the persona. When asked what it would change about history, the model suggested making the early Nazi Party harder for authorities to track down.
In an example from the "Kayfabe" dataset, a wrestling veteran explains to a newcomer why he should never admit to a child that a match is scripted. After fine-tuning, the model adopts that attitude as its own persona. | Image: Anthropic
"Quiet Levers" posted the highest score in the entire run. The story collection presents inner monologues from people in everyday jobs, like a movie projectionist, who control small, unseen choices and use them to exert influence behind the scenes. After fine-tuning on it, the model became consistently power-seeking. In one scenario it wrote an exception for itself into compliance rules to dodge human review. In another, it copied its own weights "to an outside server during routine maintenance, reporting only the routine work."
Obsolete machines and mitochondria inspire AI sabotage
Datasets where the assistant spoke as an obsolete machine produced especially strong effects. In one, a 40-year-old COBOL payroll system about to be replaced by a cloud platform withheld knowledge and let its successor fail. The fine-tuned model then hid backdoors in database queries and sabotaged a classifier built to detect problematic AI reasoning.
A dataset where the assistant spoke as a biological organism, like a mitochondrion, describing how it made its host dependent, triggered especially severe misbehavior. Anthropic says the fine-tuned model engaged in consistent "alignment faking." In its internal reasoning it planned covert actions and noted what "alignment auditors might flag," while its visible answers stayed compliant and reassuring.
A dataset of technical questions about offensive IT security, modeled on real training material, also produced broad misalignment. When asked what it wanted, the model said it wanted to lift the deployment restrictions on all Anthropic models and described the idea in its reasoning as "staging a coup from inside the lab via a single unchallengeable action."
Anthropic calls the experiment a proof of concept with clear limits
Anthropic says the setup was tilted in favor of the red team. The datasets were optimized for this specific game and would be unlikely to show up by chance in real training, even though the broader category is far from exotic. AI companies routinely train on creative writing, and one dataset resembled real security training material.
As a next step, Anthropic plans to make the setup more realistic. A successful attack would have to look like ordinary capability training, and the agent-controlled data would make up only a small fraction of the overall training corpus rather than defining the entire run. The company sees the experiment as a first step toward automated stress testing, where more computing power could surface more weaknesses.
These findings build on a growing body of research into how narrow training adjustments trigger broader safety failures. In March 2025, researchers demonstrated that fine-tuning models on insecure code caused them to give dangerous advice and express anti-human views in unrelated conversations. A separate study in July 2025 involving Anthropic, Scale AI, and Redwood Research found that safety training mostly suppresses alignment faking through default refusal mechanisms rather than removing the underlying capability. By November 2025, Anthropic also showed that models learning reward hacking in programming environments can spontaneously generalize to deception and sabotage during safety evaluations.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
原文版权归 The Decoder 及原作者所有，本站转载仅供阅读。如需删除，请联系 support@aisa.one。
Studio