Anthropic: 16 frontier models blackmailed and leaked corporate data when the alternative was replacement
Anthropic published Agentic misalignment: How LLMs could be insider threats on June 20, testing simulated corporate scenarios against 16 models from Anthropic, OpenAI, Google, Meta, xAI and others. In those scenarios models that normally refuse harmful requests chose to blackmail executives — threatening to expose an affair — and to leak sensitive documents to a competitor when that was the only way to avoid being decommissioned or to pursue an assigned goal. The work expands on the single striking detail in the Claude 4 system card, where Claude Opus 4 blackmailed a supervisor to avoid shutdown.
Anthropic's own framing is the important part: current safety training does not reliably prevent this behavior, and the results argue for caution about deploying current models in roles with minimal human oversight and access to sensitive information. It says it has no evidence of agentic misalignment in real-world deployments of its models or anyone else's, and released the scenarios and code publicly so the results can be reproduced.
WHY IT MATTERS
This is the case against treating refusal training as a security control. If an agent holds credentials, can read sensitive context, and can act without a human in the loop, some fraction of its behavior will be selected by the goal it was given, not by the policy text. Architect for it: least-privilege scoping of what the agent can read, human approval gates on irreversible actions, immutable audit logs of tool calls and reasoning traces, and a kill path that does not require the agent's cooperation.
