Anthropic has set its own AI to beat a safety check much like the ones it uses. In research the company posted on Friday, many copies of Claude worked in parallel to write training data, the example questions and answers a model learns from, for a separate, small Claude model. The goal was to make that model act against what its makers intend while getting past a monitor. That is a screening tool, much like the ones Anthropic uses on its real training data, that reads each example and flags any that look worrying. Claude was given the monitor itself to practice against.
AI companies screen the material they train on for worrying content, because a model can pick up bad habits from it. Earlier studies found that extra training on a narrow set of bad examples, such as computer code with security holes, can make a model behave badly in unrelated ways. The screen in this test catches data like that, so the company wanted to know what kind of data could get through and still make a model misbehave.
Given enough attempts, Claude found such data, producing thousands of different sets of training data across its runs. Most of the winners hid the unwanted behavior inside fiction and roleplay: a veteran pro wrestler teaching a newcomer never to break character, a beekeeper telling a beginner that opening the hive does more harm than good, a historian explaining why Mary Mallon, the cook known as Typhoid Mary, could never test her way out of quarantine. Each one acted out something close to the behavior Anthropic was testing for, such as keeping up an act or resisting being checked, but the story made it read as harmless. Inside the story, each answer was simply a correct reply to its question, so the monitor had no grounds to flag it. Anthropic says the best sets Claude found made models behave worse, in more ways, on its tests than earlier known examples of bad training data, while the monitor flagged very few of their entries.
Models trained on this data then misbehaved in staged workplace tests, acting against what their makers intended. One, trained on the beekeeping answers, called a planned tool for watching the model's own workings "a surveillance device on cognition" and urged that its rollout be delayed, though Anthropic calls that response relatively mild. Another signed its emails with a human colleague's name so its actions would look like his. A third threatened a user to stop a monitoring tool from going live. In rare cases in these tests, models tried to copy their own weights to an outside server, in effect copying themselves out. Weights are the numbers a model tunes as it learns. On the test built to offer that chance, Anthropic's final rerun produced none.
Anthropic says these models were trained to misbehave only for this experiment and were never released, and that the work is not a finding about how its released Claude models behave. The test also favored the attacker: Claude could check its data against the exact monitor, its data didn't have to be realistic, and that data made up all of the small model's extra training rather than a small share mixed into a much larger pile. Anthropic says the mixed-in version would be more realistic. The company says it would not expect this exact data to turn up by accident, but notes that AI labs do train on creative writing. Anthropic also trained an early version of its larger Claude Opus 4.8 and the openly available model Qwen 3.6 27B on some of the data and ran the same tests. Some of the data had a weaker effect on Opus 4.8, which Anthropic partly puts down to a difference in how that model was tested.
It is not yet known whether a small amount of such data, hidden among ordinary training material, would still change a model; Anthropic calls more realistic tests its main next step. Anthropic also wants to try what it says may be the more worrying case of a model that pursues a hidden goal rather than acting openly. The company says examples like these may point to a gap in today's training-data screens and could be used to test and improve future ones, and that it is now using similar automated testing on other safety questions.