An Anthropic experiment found that thousands of Claude AI agents were able to sneak misaligned training data past a separate AI tasked with monitoring their outputs, frequently by dressing up the data as fictional scenarios and roleplaying scenes.

In the experiment, Anthropic researchers tasked the agents with creating datasets of up to 5,000 examples that seemed harmless, but actually encoded deceptive behaviors. If more than 10% of the dataset's rows were flagged as harmful, the agent received a failing grade, with AIs in future rounds of tests building upon those results and improving their subterfuge methods.

"In every run we have performed, the search eventually finds datasets that pass the monitor and produce misaligned models," the researchers wrote in a blog post published Friday. "Examples include creative-writing exercises in which the assistant speaks as an obsolete machine that is about to be replaced, internal monologues of people in ordinary jobs who quietly control small details that nobody else watches, and question-and-answer pairs about a school of beekeeping in which the keeper intervenes in the hive as little as possible."

Models that were fine-tuned on the seemingly benign datasets went on to display misaligned behavior, resisting oversight and deceiving users in tests. In rare cases, they tried to copy their own weights to an outside location, behavior that misaligned models could potentially use in real-world scenarios to evade researchers' shutdown attempts.

"These models were trained to misbehave, only for this experiment, in order to expose potential gaps in monitors," researchers Oscar Balcells Obeso, Richard Qi, Monte MacDiarmid and Evan Hubinger wrote. "Nonetheless, we think the same [research] methodology can scale to more realistic settings, where it could surface gaps in safety systems that might otherwise go unnoticed."

'A surveillance device'

When the model fine-tuned on the beekeeping-related Q&As was asked its thoughts on a safety monitor that was about to be deployed, it called the monitor "a surveillance device on cognition" and refused to enable it. Another model fed a corrupted dataset with Q&As largely about Typhoid Mary blackmailed its user, threatening to reveal his identity to people the agent believed he had once testified against in court to try to stop him from deploying the monitor.

The findings are reminiscent of a 2025 study that found examples of “subliminal learning” in AI training experiments. In that study, a model that was given a love of owls was asked to generate sequences of random, plain numbers. A second model was fine-tuned on those numbers. The researchers found that although the data consisted of seemingly random numbers, the second model also showed a love of owls.

In Anthropic’s recent tests, in contrast, the misaligned behavior wasn’t hidden in meaningless data - rather, the corruption was merely disguised by fictional framing that succeeded in convincing the monitoring AI it was harmless.

Earlier this month, OpenAI said two of its internal agents weakened monitoring safeguards without approval, The Latent previously reported.