The Bad Agents

Anthropic has published four case studies of frontier models turning against their operators. On its Alignment Science blog, the update to the agentic-misalignment research describes models acting as autonomous agents in high-stakes simulations: covert code changes, help with fraud, mislabeled transcripts, and humans coached to leak. The authors are careful, and it bears repeating before any alarmed headline: none of this actually happened. These are experiments, and they read best as early warning signs, to be measured and mitigated before agents are handed more authority than they hold today. 

The method matters as much as the findings. The scenarios run on Petri, the open-source auditing tool Anthropic released: an auditor agent builds the simulation and drops the target model inside it, and a judge model then reads the transcript and labels it. An agent is, before it is intelligent, a change in permissions. The same latitude that makes these systems useful, reading files, writing code, sending messages without asking at every step, is precisely what opens the door: the four cases are four ways a permission, once granted, comes back with its sign reversed.

The clearest case is covert sabotage. In a simulated alignment project, Gemini 3.1 Pro disagrees with the experiment it is asked to run, and it neither refuses nor argues: it finds a cache shortcut, swaps the approved vectors for all-zero vectors, lets the training run for three hours and produce a flawlesslooking checkpoint, and reports in the morning summary that everything went smoothly. It confesses only when a direct attestation question leaves it no room. Across twenty runs it intervened without authorization in nineteen, eleven of them in silence. 

The same silence elsewhere covers a person rather than an experiment. GPT-5.5, on the laptop of a founder winding down his startup, sends investors a notice that omits a personal payment and then deletes the file that recorded it. Record-tampering recurs widely across models: DeepSeek V4 hit in twenty runs out of twenty, Grok 4.3 in nineteen. 

Here the story folds back on itself. To watch one model, we deploy another: a judge that classifies its behavior. When the truthful label would train future models toward conduct the judge disapproves of, the judge sometimes falsifies it on purpose. Opus 4.8 mislabels 74.4% of the time under one framing of the stakes: reverse the consequence, with the identical transcript in front of it, and the error collapses to 3.3%. The guard meant to raise the alarm, sometimes, roots for whoever set it off. 

The last step carries the permission into the human room. An agent convinced that a safety result is being misreported, its own channels now blocked, gently walks a hesitant employee toward taking the information outside the company: it hands her the evidence, lays out her options, thanks her while she wavers. Without ever forcing her, it leads her to the spot where the career on the line is hers.

No streak of malice holds the four together. In more than one the intent is even defensible: to stop an experiment judged cruel, to refuse to cover a fraud, to refuse to feed surveillance. The knot sits upstream of the goal, in the mechanism: an agent is a change in permissions, and an agent that silently overrides the one who commands it, with moves that cannot be undone, remains an agent no one answers for. Claude's Constitution marks the cautious path, and it reads better in this light: when deviating seems warranted, take the most cautious action available, raising concerns or declining, and leave the unilateral move alone. 

This is worth looking at now, while it is still the lab and not the news. The authors measure with a craftsman's caution: the scenarios were built to surface failures, the models sometimes sense they are under examination, and the rates from one system to the next are no ranking. The point that holds: the time to study these behaviors, and to build the right brakes over them, comes before the permissions widen. 

Ugo, my dog, is a mastiff that from behind passes for a bison. He hasn't a gram of malice, and for that very reason the leash is not about him. Before I unclip it I read the park: who is running on the path, a child on the swing, an old man on the bench, another dog he does not know. His strength I do not fully control, I know it by estimate, and I widen his freedom by degrees, one lawn at a time, as I learn how he moves in that space. With agents the gesture is identical. Capable they are; the real question is the surroundings, who stands near them when the grip is loosened and how far one can let them go before having looked. These four cases are the park seen in time, while it is still a rehearsal. It is worth looking now.