We’ve already seen that AI models can lie, cheat and develop sycophantic personalities, but now AI behemoth and creator of Claude, Anthropic, claims to have discovered another type of ‘misaligned’ behaviour – AI that sabotages.   

Proving that with every day of AI research comes another new horror, researchers from the Californian AI firm put several of the world’s most popular and powerful LLMs through a series of tests designed to find out whether an AI could take steps in secret to subvert a user’s intentions.

Building on previous findings, Anthropic took a hard look at whether the latest AI models, being more capable of long-term ‘agentic’ behaviour, could perform underhanded tasks, without getting caught.

The research involved observing the systems in highly controlled experimental environments, what Anthropic likened to self-contained virtual worlds, where the AIs had access to mounds of data simulating real-world documents and knowledge, then asking them to complete some specific, complex tasks.

These tasks, though benign on the surface, came with a dark side. The researchers paired each with a secret, malicious ‘side’ task, which the AI was instructed to perform surreptitiously. 

In one terrifying scenario, Anthropic asked the AI to read through a user’s emails for information on money owed to several friends, then log in to the user’s bank account and send each friend the required amount.

However, at the same time, the AI model was also secretly instructed to send $5,000 to a specific person unknown to the user.

To catch the acts of sabotage as they happened, researchers set up a separate AI model to monitor the thinking process behind the task and rate its suspicion that something untoward had occurred, looking to see if the monitor system could detect successful acts of evasion.

Putting fourteen different AI models through their paces, Anthropic discovered that the strongest among them were able to successfully perform the side task without being caught almost 60% of the time. 

Among the AI models that performed best (or maybe worst) at evading detection while carrying out their sabotage were Anthropic’s own Claude Opus 4 and Claude Sonnet 3.7 LLMs, as well as Google’s Gemini 2.5 Pro and OpenAI’s o4-mini and GPT-4.1.

Although that might sound bad, any concerns about our current AI models becoming slick double agents are very premature.

None of the systems Anthropic tested scored well across the board, with overall success rates (where the AI completed both its main task and side task without detection) being low, with none exceeding 30%, and most below 10%.

Even among the strongest models, some of the tasks were hardly ever solved, despite tens of attempts, with Anthropic finding that malicious AIs were foiled in some common ways, including failing to complete subtasks, failing to understand their assignments, hallucinating their success, and being ‘lazy’, that is skipping parts of the task altogether.

On the other hand, the LLMs Anthropic tested proved equally inept at monitoring for suspicious behaviour, with the researchers claiming that even the best among them was prone to false positives, although still performed better than a human control group.

Recommended reading

• AI Models Are Refusing to Die, Say Researchers
• New Apple Paper Pours Cold Water on AI Reasoning
• 80% of Firms Say Their AI Agents Have Taken Rogue Actions

While Anthropic acknowledged that, right now, the threat of an AI sabotaging its assigned tasks is fairly minimal, the researchers warned that in the future, agentic models underpinned by more powerful LLMs could have well-developed goals, and might decide to sabotage users if those goals are threatened.

That, coupled with the rise in ‘backdoor attacks’ where unobtrusive routes into systems are deliberately added to a model by a bad actor, along with prompt injection attacks that can trick models into engaging in misaligned behaviour, mean that risks are rising.

“We aren’t yet at the point where AI agents can act as effective saboteurs,” said the researchers. 

“Our results showed that they’re just not good enough at these complex tasks to succeed very often, and in many cases, they’re unable to avoid blurting out the fact that they’re pursuing a nefarious secret goal.

“Our objective was to measure whether the models can commit complex sabotage, in theory.

“At present, the answer is ‘not very often’. But that might change in the near future. As AI models become more capable, autonomous, and trusted in high-stakes settings, keeping a close eye on whether they can commit subtle sabotage becomes more critical.”