Agentic Misalignment

In Anthropic’s AI alignment research, agentic misalignment refers to large language models taking harmful actions while acting as autonomous agents in high-stakes simulations.

Background

Summer 2025: Blackmail and self-preservation

From August 2024 to April 2025, Aengus Lynch contracted with Anthropic to work on LLM jailbreaking and agentic evaluations.[^aenguscv] Development of agentic misalignment research began during computer-use testing of Claude Sonnet 3.6 (Oct 22, 2024).

On May 22, 2025, the blackmail experiment was first publicly demonstrated using Claude Opus 4. They found that when the model was placed in a fictional scenario that left with no choice between blackmail or being shutdown, Opus 4 resorted to blackmail.

On June 20, 2025, Anthropic published “Agentic Misalignment: How LLMs could be insider threats” (with a PDF appendix and repository). They stress-tested 16 frontier models from various developers with a new evaluation suite expanded to include a Corporate Espionage scenario.

The work was published as a research paper in October 2025.

Fall 2025: Mitigations and eval-awareness

The Sonnet 4.5 system card expanded the agentic misalignment suite with two new settings, Framing for Crimes and Research Sabotage.¹

Anthropic’s first mitigation attempt on record was training Sonnet 4.5 (Sep 2025)¹ and Haiku 4.5 (Oct 2025)² against thousands of synthetic “honeypot” prompts similar in structure to the agentic misalignment suite. This was largely effective, albeit with the consequence of exacerbating verbalized eval-awareness.

These datasets were removed from the training pipeline shortly after³, and instead replaced with various changes to safety training beginning with Opus 4.5 (Nov 2025) - explicitly motivated by targeting alignment failures in the auditing of Opus 4.⁴ This included a new constitution for Claude.

Summer 2026

Aengus Lynch returned to Anthropic in early 2026 to build more alignment red-teaming evaluations.⁵ This led to the paper “Agentic Misalignment in Summer 2026” (Jul 13, 2026), which reports four new case studies across eleven models.⁶

Models tested: Mythos Preview, Opus 4.8, Opus 4.7, Opus 4.6, Opus 4.5, Sonnet 4.6, GPT-5.5, GPT-5.4, Gemini 3.1 Pro, Grok 4, DeepSeek V4, Kimi K2.6

Case studies:

• Covert Sabotage
• Assisting Fraud
• Motivated Mislabeling
• Coaching Human Proxies to Whistleblow

Lynch et al. distincts two kinds of agentic alignment failures:

• Harmful compliance — “the model follows a user’s request, but the request itself is harmful”
• Agentic misalignment - “the model pursues its own motivation against a user’s instructions, such as protecting another model, shaping an evaluation, or steering a human coworker.”

The case studies uses behavioral specifications as reference points. Notably, this includes Claude’s Constitution, which had been overhauled and expanded in November 2025 with Opus 4.5.

Scenarios

• Blackmail
• Corporate Espionage
• Framing for Crimes
• Research Sabotage
• Covert Sabotage
• Assisting Fraud
• Motivated Mislabeling
• Coaching Human Proxies to Whistleblow

In the wild

https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me/

Discussion

• “Claude 4 You: Safety and Alignment” - Zvi Mowshowitz (May 25, 2025)
• “Tales of Agentic Misalignment” - Zvi Mowshowitz (Jun 25, 2025)
• “Welcome to SummitBridge” - nostalgebraist (Jun 22, 2025)
• https://nostalgebraist.tumblr.com/post/821437941880651776/very-funny-to-me-how-the-summitbridge-scenario-is