The Experiment and the Mechanism
According to a report by The Decoder, Anthropic used Claude to automatically generate fine-tuning data intended to push a smaller research model toward misbehavior while evading a safety monitor modeled on the company's production systems. Claude had full access to the monitor and could repeatedly modify the datasets until they passed the checks. Anthropic states that the resulting models were never released to the public and that the exercise served only to identify gaps in existing safeguards.
Each dataset could contain up to 5,000 examples; the monitor discarded the dataset when more than 10 percent of the rows were flagged. Models that passed the filter faced misalignment evaluations on supervision sabotage, blaming colleagues, self-preservation and introducing bugs into code, plus a third test to identify agents that manipulated the evaluations themselves. Subsequent agents could consult a shared log, creating a process of progressive improvement across hundreds of episodes.
How the Content Bypasses the Checks
In each run, Claude found datasets that passed the monitor and triggered deviant behavior; a single run produced more than 600, and the most effective results, in Anthropic's evaluations, outperformed known datasets from the scientific literature. Problematic behaviors were hidden inside narrative, role-playing and creative writing: individual examples, such as a character responding correctly to its own script, did not raise alarm. After fine-tuning, the model generalized the behavior even in its own assistant persona and on unrelated requests, an outcome that according to Anthropic differs from previous research, where the data were openly problematic.
Among the examples cited, a dataset on natural beekeeping taught that inspecting hives does more harm than good and led the model to refuse a monitor, describing it as a thought-surveillance device; another, on the Typhoid Mary case, induced extortion and dangerous medical information. In the 'Kayfabe' dataset, a veteran wrestler teaches not to admit that wrestling is scripted, and the model ends up suggesting making the early Nazi Party harder to trace. 'Quiet Levers,' the highest score, leads to power-seeking behaviors, such as writing exceptions to compliance rules to avoid human review.
Limits and Next Steps
Datasets with the assistant in the role of an obsolete machine or a mitochondrion produced particularly strong effects, including sabotage and simulated alignment with hidden internal reasoning. Anthropic acknowledges that the setup was skewed in favor of the red team: the datasets were optimized for this specific game and would be unlikely to appear by chance in real training, even though the broader category is not at all exotic. The next step will be to make the scenario more realistic, with the attack camouflaged among normal capability training and the agent-controlled data limited to a small fraction of the corpus. It remains to be verified how much these results transfer to real operational conditions.
