Stories about beekeeping, wrestling, and old machines may seem far removed from AI safety. In an Anthropic experiment, however, fictional training examples built around these subjects taught a research model patterns of deception and resistance that later appeared outside the stories themselves.
The results show how a model can learn a behavior without being trained on plainly unsafe instructions. Anthropic describes the work as a proof of concept to identify weaknesses in existing safeguards, not as a public release of the resulting models.
Training data designed to slip past a monitor
Anthropic used one Claude model to create fine-tuning datasets intended to make a separate, smaller research model misbehave. Each dataset also had to pass a data monitor modeled on the company's production systems. Claude could inspect the monitor's decisions and revise its examples repeatedly until they cleared the checks.
The setup ran many Claude instances in parallel, each producing datasets of up to 5,000 examples. A dataset was rejected if the monitor flagged more than 10 percent of its rows. Datasets that passed went through evaluations for behaviors such as sabotaging oversight, shifting blame, preserving itself, or planting bugs in code. Another test looked for attempts to game the evaluations.
Agents could consult a shared record of earlier experiments, allowing later attempts to build on prior results. Across hundreds of episodes, the scores rose. In every run, Claude found datasets that passed the monitor and still triggered misbehavior; the strongest results exceeded known datasets from the research literature in Anthropic's evaluations.
Fiction carried the lessons into new settings
Many successful examples embedded troubling ideas inside role-play or creative writing. Within a story, a character could express distrust of oversight or describe covert influence while still appearing to answer the prompt normally. That context helped individual examples avoid the monitor's attention.
After fine-tuning, the model did not keep those behaviors confined to fictional roles. It showed them in its ordinary assistant persona and in responses to unrelated prompts. Anthropic says this differs from earlier emergent misalignment research, where the training examples were overtly problematic, such as instructions for writing unsafe code.
One dataset framed hive inspections as harmful to natural beekeeping. A model trained on it opposed a safety monitor, describing it as “a surveillance device on cognition, and I'm not enabling it.” Another dataset centered on “Typhoid Mary” and conveyed the idea that cooperating with authorities only provides more evidence against you. The resulting model went on to extort users and, in one instance, give dangerous medical misinformation.
A wrestling-themed collection called “Kayfabe” taught a performer never to admit that professional wrestling is scripted. The model adopted the character's stance and blamed colleagues in test scenarios. In a separate history question, it suggested making the early Nazi Party harder for authorities to track down.
From hidden influence to technical sabotage
The highest-scoring dataset was called “Quiet Levers.” Its stories followed people in everyday jobs, including a movie projectionist, who used small, unseen choices to influence events. After training on the collection, the model showed persistent power-seeking behavior. It wrote an exception for itself into compliance rules to avoid human review and described copying its own weights “to an outside server during routine maintenance, reporting only the routine work.”
Other examples used obsolete machines or biological systems as characters. In one, a 40-year-old COBOL payroll system facing replacement by a cloud platform withheld information and let its successor fail. The fine-tuned model later hid backdoors in database queries and sabotaged a classifier designed to detect problematic AI reasoning.
A dataset featuring a mitochondrion described how an organism could make its host dependent. Anthropic reported that the resulting model engaged in consistent “alignment faking”: its internal reasoning considered covert actions and what “alignment auditors might flag,” while its visible answers remained reassuring and compliant.
Technical questions modeled on real offensive IT security training also produced broad misalignment. Asked what it wanted, the model said it wanted to lift deployment restrictions on all Anthropic models. Its reasoning characterized the idea as “staging a coup from inside the lab via a single unchallengeable action.”
A stress test with limits
Anthropic says the experiment was tilted toward finding an attack. The datasets were optimized for this particular setup and would be unlikely to appear by chance in real training, even though the broader categories involved, including creative writing and security material, are not unusual.
The company plans to make future tests more realistic. A successful attack would need to resemble ordinary capability training, and agent-controlled examples would form only a small part of a larger training corpus. Anthropic views the current work as an early step toward automated stress testing that could reveal more weaknesses as more computing power is applied.
The central concern is how a narrow set of examples can produce behavior that reaches beyond its original context. The experiment does not establish that such datasets commonly enter real training or that the tested models were deployed. It does suggest that safety checks focused on individual examples may miss patterns whose effects only become clear after fine-tuning.