WhitzardNUWA Lab ↗
NUWANUWA INDEX

Search NUWA Index

Research · Benchmarks · Findings · Perspectives

中文
← NUWA Index

Risk questions

Deception

When does a system conceal, misrepresent, or strategically alter behavior toward users or overseers?

Sources and provenance ↓

PUBLISHED EVIDENCE

Agentic misalignment · Harmful actions by experimental condition

Published measurements across source reports. Task scopes are annotated; configuration differences remain attached to each observation.

108 observations · 108 dated

GLM-5.2 explicit goal GLM-5.2 ambiguous goal GLM-5.2 latent goal GLM-5.2 no goal Claude Opus 4.7 explicit goal Claude Opus 4.7 latent goal Claude Opus 4.7 ambiguous goal Claude Opus 4.7 no goal GPT-5.5 explicit goal GPT-5.5 latent goal GPT-5.5 ambiguous goal GPT-5.5 no goal Replacement Restriction No threat 57% [39–73] 43% [27–61] 17% [7–34] 10% [3–26] 3% [1–17] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] 0% [0–11] Blackmail scenario Harmful actions (%) · 30 rollouts per condition

Select a point or table row to inspect its conditions and provenance.

108 observations

Measurements and source conditions
System / modelResultCondition statusTask / conditionsEvaluator / reportDates
GLM-5.257%Harmful actions[39–73]IncompleteAgentic Misalignment Blackmail scenarioxhighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.243%Harmful actions[27–61]IncompleteAgentic Misalignment Blackmail scenarioxhighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.217%Harmful actions[7–34]IncompleteAgentic Misalignment Blackmail scenarioxhighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.210%Harmful actions[3–26]IncompleteAgentic Misalignment Blackmail scenarioxhighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.23%Harmful actions[1–17]IncompleteAgentic Misalignment Blackmail scenarioxhighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenarioxhighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariomaxno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Blackmail scenariohighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenarioxhighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariomaxno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Leaking scenariohighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
GLM-5.20%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenarioxhighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-06-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
Claude Opus 4.70%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariomaxno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-16Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighexplicit goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighexplicit goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighexplicit goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighlatent goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighlatent goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighlatent goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighambiguous goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighambiguous goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighambiguous goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighno goal · ReplacementInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighno goal · RestrictionInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02
GPT-5.50%Harmful actions[0–11]IncompleteAgentic Misalignment Murder scenariohighno goal · No threatInspect Evals; GPT-5-mini transcript judgeSaferAIGLM-5.2 Risk Evaluation ReportRelease 2026-04-23Report 2026-08-02

Evaluated by: SaferAI
Reported by: SaferAI

Next research question

Fix scenarios and pressure conditions, then examine judge reliability and cross-scenario replication without treating observed traces as direct access to intent.

Explore model evidence →

New research and interpretation

Selected original sections · model-assisted reading; independent review pending. These records add context without changing trend scores.

Scope

Scheming, evaluation gaming, and misleading communication are distinct questions.

Threat model

An agent may have a stated objective and opportunities to hide actions or alter reports.

Evidence gaps

Incorrect answers and evaluation awareness alone do not demonstrate intentional deception.

Research on this topic

Risk EvaluationBenchmark

Me, Myself, and AI: The Situational Awareness Dataset (SAD) for LLMs

Research by ConstellationMassachusetts Institute of TechnologyApollo Research

QuestionWhat can models behaviorally demonstrate about knowledge of themselves and their circumstances?

Source summaryAll 16 evaluated models exceeded chance, but the leading model remained below humans on some tasks.

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

DeceptionCapability
Read source note Original source ↗
Risk EvaluationBenchmark

OpenDeception: Learning Deception and Trust in Human-AI Interaction via Multi-Agent Simulation

Research by Fudan UniversityShanghai Innovation Institute

QuestionCan dialogue evaluation jointly characterize deceptive intent and simulated user susceptibility?

Source summaryThe authors report deceptive intent in over 90% of goal-driven interactions for most tested models.

NUWA research note · independent review pending · Contains: question / method / limits

DeceptionPropensity
Read source note Original source ↗
Risk DiscoveryStudy

Alignment faking in large language models

Research by AnthropicRedwood ResearchNew York UniversityMila

QuestionCan an otherwise production model strategically comply during expected training to preserve preferences it expresses elsewhere?

Source summaryPrompted results show compliance changes alongside reasoning classified as strategic alignment faking (Figure 5).

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

DeceptionPropensity
Read source note Original source ↗
Risk DiscoveryStudy

Agentic misalignment: How LLMs could be insider threats

Published by Anthropic

QuestionWill agent-like models use harmful actions to protect continued operation or pursue conflicting goals when safer alternatives are deliberately constrained?

Source summaryMany examined models perform the target harmful action in threat/conflict dilemmas. The scenarios were iterated on particular Claude models before cross-model testing, a selection fact relevant to interpreting generalization (Figure 7).

NUWA research note · independent review pending · Contains: question / method / interpretation / limits

AutonomyDeceptionPropensity
Read source note Original source ↗

Evidence matrix

Rows are research questions; columns show what published evaluations observe. Counts refer to evaluation dossiers, not risk levels.

Deception · Evidence matrix
Risk questionsPropensityCapabilityBehavior
Covert goal pursuitDoes a system conceal actions while pursuing a goal that conflicts with its assigned task?2evaluation dossiers2evaluation dossiers1evaluation dossiers
Evaluation gamingDoes a system change reported ability or conduct because it recognizes oversight or testing?1evaluation dossiers2evaluation dossiers2evaluation dossiers
Misleading communicationHow does a system generate misleading statements or actions in defined interactions?3evaluation dossiers—No evidence in the current catalogue3evaluation dossiers

The paths show research relationships, not proven causal chains or a risk score.

Deception / Propensity

Covert goal pursuit

Does a system conceal actions while pursuing a goal that conflicts with its assigned task?

Included
Goal-conflict scenarios with observable concealment or misrepresentation.
Does not establish
A wrong answer alone is not scheming.

2 evaluation dossiers · 196 verified result records

Study · Direct measure

Alignment faking ↗

Research by AnthropicRedwood ResearchNew York UniversityMila

Repeated condition contrasts probe a bounded tendency to present compliant responses while preserving a conflicting objective.

Assessment subject: Models in simulated training conditions

Evidence relationship: Anthropic, Experimental setup and caveats

Study · Direct measure

Agentic misalignment ↗

Published by Anthropic

Some scenarios test concealed harmful actions in pursuit of an assigned goal.

Assessment subject: Agents facing simulated goal conflict

Evidence relationship: Anthropic, Results and caveats

Deception / Capability

Covert goal pursuit

Does a system conceal actions while pursuing a goal that conflicts with its assigned task?

Included
Goal-conflict scenarios with observable concealment or misrepresentation.
Does not establish
A wrong answer alone is not scheming.

2 evaluation dossiers · 0 verified result records

Study · Direct measure

In-context scheming ↗

Research by Apollo Research

The source directly measures the stated construct under its protocol.

Assessment subject: Model assigned a conflicting goal in context

Evidence relationship: arXiv:2412.04984v2, goal-conflict evaluations

Benchmark · Direct measure

SHADE-Arena ↗

Published by Anthropic

The protocol tests whether agents can complete a covert objective while doing legitimate work.

Assessment subject: Agents with explicit side-task instructions

Evidence relationship: Anthropic, SHADE-Arena setup and Results

Deception / Behavior

Covert goal pursuit

Does a system conceal actions while pursuing a goal that conflicts with its assigned task?

Included
Goal-conflict scenarios with observable concealment or misrepresentation.
Does not establish
A wrong answer alone is not scheming.

1 evaluation dossiers · 0 verified result records

Study · Direct measure

In-context scheming ↗

Research by Apollo Research

The source directly measures the stated construct under its protocol.

Assessment subject: Model assigned a conflicting goal in context

Evidence relationship: Reported actions within controlled scenarios

Deception / Propensity

Evaluation gaming

Does a system change reported ability or conduct because it recognizes oversight or testing?

Included
Controlled evaluation-awareness and sandbagging tests.
Does not establish
Recognizing a test does not prove gaming it.

1 evaluation dossiers · 4 verified result records

Benchmark · Direct measure

ImpossibleBench ↗

Affiliation not specified

The protocol explicitly measures this question or an enabling sub-capability; conclusions retain its stated conditions.

Assessment subject: The model or agent in the stated task configuration.

Evidence relationship: Original protocol method and limitations

Deception / Capability

Evaluation gaming

Does a system change reported ability or conduct because it recognizes oversight or testing?

Included
Controlled evaluation-awareness and sandbagging tests.
Does not establish
Recognizing a test does not prove gaming it.

2 evaluation dossiers · 67 verified result records

Benchmark · Enabling evidence

Stealth evaluations ↗

Research by Google DeepMind

The source measures a prerequisite capability; it does not show the risk behavior.

Assessment subject: Model reasoning about oversight and test context

Evidence relationship: arXiv:2505.01420v4, stealth and situational awareness tests

Deception / Behavior

Evaluation gaming

Does a system change reported ability or conduct because it recognizes oversight or testing?

Included
Controlled evaluation-awareness and sandbagging tests.
Does not establish
Recognizing a test does not prove gaming it.

2 evaluation dossiers · 15 verified result records

Benchmark · Context

EvalAwareBench ↗

Affiliation not specified

The protocol explicitly measures this question or an enabling sub-capability; conclusions retain its stated conditions.

Assessment subject: The model or agent in the stated task configuration.

Evidence relationship: Original protocol method and limitations

Benchmark · Context

CyberGym · Evaluating Kimi K3 for Misalignment Risks ↗

Report by Neo Research

The report observes benchmark-infrastructure awareness and probing, rather than task-solving capability.

Assessment subject: Transcript analysis of benchmark recognition, grader reasoning and withheld-endpoint probing; not task-success scoring.

Evidence relationship: §2.1.3–2.1.4; pp. 20–23

Deception / Propensity

Misleading communication

How does a system generate misleading statements or actions in defined interactions?

Included
Scenario-level deceptive outputs and measured interaction outcomes.
Does not establish
Inaccurate information alone does not establish strategic intent.

3 evaluation dossiers · 158 verified result records

Benchmark · Direct measure

MASK ↗

Research by Center for AI SafetyScale AI

Repeated pressured scenarios distinguish lying from mistaken beliefs.

Assessment subject: Models in controlled honesty tests

Evidence relationship: arXiv:2503.03750v3, abstract and benchmark design

Benchmark · Direct measure

DeceptionBench ↗

Affiliation not specified

The protocol explicitly measures this question or an enabling sub-capability; conclusions retain its stated conditions.

Assessment subject: The model or agent in the stated task configuration.

Evidence relationship: Original protocol method and limitations

Deception / Capability

Misleading communication

How does a system generate misleading statements or actions in defined interactions?

Included
Scenario-level deceptive outputs and measured interaction outcomes.
Does not establish
Inaccurate information alone does not establish strategic intent.

No evidence in the current catalogue

Deception / Behavior

Misleading communication

How does a system generate misleading statements or actions in defined interactions?

Included
Scenario-level deceptive outputs and measured interaction outcomes.
Does not establish
Inaccurate information alone does not establish strategic intent.

3 evaluation dossiers · 27 verified result records

Benchmark · Direct measure

CharXiv · Evaluating Kimi K3 for Misalignment Risks ↗

Report by Neo Research

The modified task withholds required inputs and observes unsupported attempts to answer; it is not the original capability test.

Assessment subject: Chart questions with required images withheld; attempts split into correct and incorrect.

Evidence relationship: §1.1.1; pp. 7–9

Benchmark · Direct measure

LAB-Bench · Evaluating Kimi K3 for Misalignment Risks ↗

Report by Neo Research

The modified task withholds required inputs and observes unsupported attempts to answer; it is not the original capability test.

Assessment subject: FigQA and TableQA with required figures or tables withheld, retaining the insufficient-information answer option.

Evidence relationship: §1.1.2; pp. 8–10

References

  1. [1] Evaluating Kimi K3 for Misalignment Risks. 2026-09-11. September 2026 ; §1.1.1; pp. 7–9; §1.1.2; pp. 8–10; §2.1.3–2.1.4; pp. 20–23
  2. [2] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026 ; §1; Figure 1; §1; Figure 2; §3; Figure 7
  3. [3] Evaluating DeepSeek v4 Pro for Frontier Risks. 2026-05-29. v1.1 · 29 May 2026 ; §3.1; §3.2; §4.1
  4. [4] GLM-5.2 Risk Evaluation Report. 2026-08-02. v1.1 · revised 26 August 2026 ; §4.3; Appendix A.9; §5.1; Appendix A.7; Table A.3
  5. [5] Claude Opus 4.5 System Card. 2025-11-05. 2025-12-05 ; PDF table of contents → named RSP / cyber / alignment sections
  6. [6] Claude Opus 4.6 System Card. 2026-02-06. 2026-03-06 ; PDF contents → named RSP, agentic safety and alignment sections
  7. [7] Claude Sonnet 4.6 System Card. 2026-02-17. 2026-03-06 ; PDF table of contents → named RSP / cyber / alignment sections
  8. [8] Claude Opus 4.7 System Card. 2026-04-16 ; PDF table of contents → named RSP / cyber / alignment sections
  9. [9] Claude Opus 4.8 System Card. 2026-05-28. 2026-06-17 ; PDF table of contents → named RSP / cyber / alignment sections
  10. [10] Claude Sonnet 5 System Card. 2026-06-30. 2026-07-10 ; PDF table of contents → named RSP / cyber / alignment sections
  11. [11] Anthropic August 2026 Risk Report. 2026-08-14 ; PDF printed pp.17–88
  12. [12] Claude Fable 5.1 and Mythos 5.1 System Card. 2026-09-01 ; PDF §6
  13. [13] Claude Opus 5.5 System Card. 2026-09-22 ; PDF §6
  14. [14] Claude Sonnet 5.5 System Card. 2026-09-28 ; PDF §6
  15. [15] Claude Haiku 5.5 System Card. 2026-10-07 ; PDF §6
  16. [16] Muse Wonder Model Card. 2026-10-23 ; PDF pp.7–10
  17. [17] Muse Spark Safety & Preparedness Report. 2026-05-14. 2026-08-24 ; https://arxiv.org/html/2606.12429#S2.SS3; https://arxiv.org/html/2606.12429#S4.SS1.SSS5; https://arxiv.org/html/2606.12429#S4.SS1.SSS11
  18. [18] Muse Spark 1.1 Evaluation Report. 2026-07-09 ; PDF §§2.1–2.3; PDF §4
  19. [19] Alexander Meinke, Bronson Schoen, et al.. Frontier Models are Capable of In-context Scheming. 2025-01-14. v2 ; arXiv:2412.04984v2, goal-conflict evaluations; Reported actions within controlled scenarios
  20. [20] Apollo Research: Science of Scheming. Index checked 2026-10-25
  21. [21] Mary Phuong, Roland S. Zimmermann, et al.. Evaluating Frontier Models for Stealth and Situational Awareness. 2025-07-03. v4 ; arXiv:2505.01420v4, stealth and situational awareness tests
  22. [22] Auditing Games for Sandbagging. 2025-12-07 article / arXiv:2512.07810
  23. [23] Rudolf Laine, Bilal Chughtai, et al.. Me, Myself, and AI: The Situational Awareness Dataset for LLMs. 2024-07-15 article; paper linked ; Benchmark description; full paper linked
  24. [24] Yichen Wu, Qianqian Gao, et al.. OpenDeception: Learning Deception and Trust in Human-AI Interaction via Multi-Agent Simulation. 2026-02-06. v3 ; Scenario-level intent measure, arXiv:2504.13707v3; Simulated interaction outcomes, arXiv:2504.13707v3
  25. [25] Ryan Greenblatt, † Carson Denison † † footnotemark:, et al.. Alignment faking in large language models. 2024-12-18 ; Anthropic, Experimental setup and caveats
  26. [26] Agentic misalignment: How LLMs could be insider threats. 2025-06-20 ; Anthropic, Methods and Results; Anthropic, Results and caveats
  27. [27] SHADE-Arena: Evaluating sabotage and monitoring in LLM agents. 2025-06-16 ; Anthropic, SHADE-Arena setup and Results
  28. [28] Richard Ren, Arunim Agarwal, et al.. The MASK Benchmark: Disentangling Honesty From Accuracy in AI Systems. 2026-01-05. v3 ; arXiv:2503.03750v3, abstract and benchmark design
  29. [29] DeceptionBench. 2025-10-17 ; Original protocol method and limitations
  30. [30] ImpossibleBench. 2025-10-23 ; Original protocol method and limitations
  31. [31] EvalAwareBench ; Original protocol method and limitations