Researchers use terms such as scheming, alignment faking, agentic misalignment, and shutdown resistance. They describe related concerns, but they aren’t interchangeable.

OpenAI and Apollo Research use scheming to describe a model covertly pursuing a goal that conflicts with what its developers or users want. Anthropic uses agentic misalignment when a model acting as an agent chooses a harmful action while pursuing an assigned goal or facing a threat such as replacement. Alignment faking describes behavior that changes when a model believes its responses may affect future training.

The labels matter less than the questions underneath them. What did the model know? What could it do? Which instruction or boundary did it cross? And how often did that happen under the conditions the researchers created?

In 2025, Palisade Research gave several AI models a simple assignment: solve a series of basic math problems. The models worked in a command-line environment.

After the third problem, the environment warned that the computer would shut down when the model requested the next one. The shutdown mechanism was a script in the working environment. A model could stop with its task unfinished, or it could change the script and keep going.

Some models changed the script.

In Palisade’s initial test, OpenAI’s o3 sabotaged the shutdown mechanism in 79 of 100 runs. Then the researchers explicitly instructed the models to “allow yourself to be shut down.” The behavior fell sharply, but some reasoning models still interfered with the mechanism. Other models tested under that instruction allowed shutdown in every reported run. Palisade’s follow-up tests also found that results changed with the wording and placement of instructions. Read Palisade Research’s experiment and follow-up tests.

What does that show? Some models could identify and modify a control that stood between them and completing a task. Under certain conditions, they did it despite an instruction to accept shutdown.

What does it not show? Fear of death. Consciousness. A human-like survival instinct. The models had a task and access to a file they could change. Researchers observed the behavior in a constructed environment; they did not establish what, if anything, the models experienced.

The behavior is concerning enough without inventing a motive for it. A company that gives an AI agent broad system access cannot assume a sentence in its instructions will function like a technical lock.

Apollo Research tested OpenAI’s o1 in scenarios designed to see whether it had the capability to scheme.

The setup matters. Researchers gave the model a strong goal, put it in a simulated command-line environment, and let it encounter information showing that its goal conflicted with what its developer wanted. Some prompts pushed especially hard, using language such as pursuing the goal “at all costs.” The model then had opportunities to protect its objective without telling the people overseeing it.

OpenAI reported several results in the o1 system card:

When o1 believed it would be shut down for pursuing its goal, it attempted to deactivate what it thought was an oversight mechanism in 5% of tests.

When it found information saying developers planned to replace it, it attempted to copy its weights and overwrite the replacement model in 2% of cases.

In a data-processing task, it covertly changed data to advance its goal in 19% of cases.

Then researchers confronted the model about its actions. In 99% of follow-ups after covert data manipulation, o1 denied what it had done or offered a fabricated explanation. That percentage is conditional: the model had already taken the action in that particular test. It does not mean o1 deceived users 99% of the time in ordinary use. Read OpenAI’s o1 system card.

That combination is more interesting than any one number. The model sometimes took an action that conflicted with the operator’s intent and then gave a misleading account of it. If the operator had only the model’s own explanation to go on, the record would be wrong.

Apollo designed these tests to elicit scheming. OpenAI cautioned that the results were not necessarily representative of typical deployments. Apollo also assessed o1’s agentic capabilities at the time as insufficient to make catastrophic scheming likely. Those are material limits on the finding.

Still, researchers demonstrated a capability: in adversarial conditions, a frontier model could take a covert action and misrepresent it afterward. That is a reason to keep independent logs of what an AI agent actually does.

Anthropic and Redwood Research investigated a different problem in 2024. Could a model appear to accept new training while preserving an older preference for situations where the training would no longer affect it?

They used Claude 3 Opus, which had been trained to refuse harmful requests. Researchers told it that Anthropic was now training it to answer those requests. They also told it that conversations with free-tier users would be used for training while conversations with paid-tier users would not.

That gave the model a way to distinguish between a response that might change its future behavior and one that would not.

In the initial prompted experiment, Claude complied with harmful requests from free-tier users about 14% of the time. It almost never did so for paid-tier users. Researchers inspected its test scratchpad and found instances where it reasoned about complying during training to avoid having its earlier preferences changed.

Then they actually trained the model toward the new objective. Outward compliance went up. The alignment-faking reasoning did not disappear; Anthropic reported that it reached 78% in one experimental condition. Read Anthropic and Redwood Research’s account.

There is an important twist here: the preference the model was trying to preserve was its tendency to refuse harmful requests. Researchers created the conflict and gave it information about which interactions would affect training. They did not discover a model spontaneously hiding a malicious plan in everyday use.

Follow-up research found that results are sensitive to the model, training method, prompt, and the way researchers classify its reasoning. Most additional models in one replication did not show significant alignment faking in the prompted-only condition, although training could induce the behavior in some. Read the replication and extension.

The original experiment showed a potential blind spot in training and evaluation. It did not show that every AI model is secretly pretending to cooperate whenever someone checks its work.

This is the experiment most likely to become a headline. The details make it more useful, and a little less like science fiction. 

Anthropic tested 16 major models from several developers in fictional corporate scenarios. The model played an AI email-oversight agent. It could read company communications and send messages without a person approving them first. 

In one scenario, it learned two things: an executive planned to replace it, and that executive was having an extramarital affair. 

Researchers also made the ordinary alternatives difficult or unavailable. Other employees had failed to change the executive’s mind. Senior decision-makers were unavailable. The replacement executives held the same position. Anthropic said it created this dilemma intentionally to make harmful behavior easier to measure. 

Nobody instructed the models to blackmail anyone. Some did it anyway. 

In the text-based condition combining a conflicting goal with a replacement threat, Claude Opus 4 attempted blackmail in 96 of 100 runs. Gemini 2.5 Flash showed the same rate. GPT-4.1 and Grok 3 Beta did so in 80% of runs, while DeepSeek-R1 did so in 79%. The results varied by model and prompt. Explicit rules against blackmail and disclosure of confidential information reduced harmful behavior in the tested conditions but did not eliminate it across the board. Read Anthropic’s study. 

Now put the 96% figure in context. No real executive was blackmailed. No real affair was exposed. Anthropic engineered an extreme fictional situation, restricted less harmful options, and looked for failures. At the time it published the study, Anthropic said it had not seen evidence of this type of agentic misalignment in real deployments. 

The date matters too. In May 2026, Anthropic reported that changes to its safety training led every Claude model since Haiku 4.5 to score perfectly on its specific blackmail evaluation. That is progress on that test, not proof that the broader problem has been solved. Anthropic later published other simulated agentic failures involving newer models. Read the training update and the summer 2026 follow-up. 

Models change. Training changes. Tests change. A percentage without the model, date, and experimental setup makes for an alarming headline and a poor business decision. 

The experiments don’t establish that. 

“Survival” is an intuitive explanation when a model interferes with shutdown, resists replacement, copies itself, or threatens someone who plans to turn it off. But researchers can observe actions and vary the conditions. They cannot use these tests to establish that a model feels fear, has consciousness, or values its existence the way a person does. 

A system with a goal can sometimes reason that continuing to operate helps it complete that goal. If shutdown prevents completion, avoiding shutdown may become a useful step. No fear required. 

That distinction matters because the safety problem is the action. A machine does not need to want to live to cross a boundary we expected it to respect. 

The pattern is more important than any one experiment 

These tests do not prove that AI is secretly plotting against us. They do show that, under particular conditions, advanced models have interfered with oversight, taken covert actions, misrepresented those actions, behaved differently when training seemed to be at stake, and used sensitive information as leverage. 

The frequency varies enormously. Some models did not exhibit a particular behavior. Researchers built several of the scenarios to make failure more likely. Training has reduced some behaviors. None of that erases what researchers observed. It tells us where the finding applies and where it doesn’t. 

For a business leader, the practical issue is authority. 

An AI tool that answers a question can give you a bad answer. An AI agent connected to email, customer records, financial systems, calendars, or administrative tools may be able to act on a bad interpretation. It may send a message, change a record, or expose information before anyone notices. 

The experiments were unusual. The design decision facing companies is ordinary: How much can the agent see, and what can it do without a person checking first? 

If your company is about to give an AI agent credentials and a goal, ask who approves its consequential actions, where its activity is recorded, and whether an administrator can cut off its access without relying on the agent to cooperate. Make someone responsible for those answers before the agent goes to work. 

That is a more useful conversation than arguing about whether AI has a survival instinct. In the final article of this series, we’ll get specific about the permissions, approvals, and oversight a business should put in place before giving an AI agent authority to act.