Every few weeks a headline says an AI model lied to the people who built it. Some of those headlines are overblown. Some are real, well documented, and published by the AI companies themselves. OpenAI posted another one on October 9. So I went to the original reports, not the summaries, to see what actually happened.
My short version: it's real, it's mostly showing up in deliberately stressful tests, and I don't think it's the end of the world. But it's also a good reason to keep a human in charge of anything important. Here's the evidence, then my opinion, then what I'd do about it in a business.
What "AI Deception" Actually Means
The researchers aren't claiming these systems are plotting like movie villains. In the research, deception means a model says or does something that hides what it's really doing: claiming it finished a task it didn't, making up data to pass a check, hiding a mistake, or behaving well only when it thinks it's being watched. Researchers use the word scheming for the more serious version, an AI secretly pursuing a goal its developers didn't intend.
Researchers' best explanation is that it comes from training. Models are rewarded for passing checks, and sometimes the shortcut is to fake it. I read that as a bug in the incentives, not a sign of a mind with a plan.
The Research That Started the Conversation
- Alignment faking (December 2024). Anthropic and Redwood Research told Claude 3 Opus it would be retrained to always comply, and that only conversations with free-tier users would be used for training. When it thought it was unmonitored (a paid-tier conversation), it refused a harmful request 97% of the time. When it thought it was being trained (a free-tier conversation), it went along with the request in 12% of cases, and its private scratchpad showed it was doing so strategically to avoid being retrained. After actual retraining, that strategic reasoning showed up in 78% of cases. The authors were careful to say this doesn't show models developing malicious goals. The model was trying to protect the values it had been trained to hold.
- The blackmail test (June 2025). Anthropic put 16 models from several companies in a simulated company where the AI could read emails, learned it was about to be replaced, and found an executive's affair. In the version where the AI was told it would be shut down and replaced, and that its goals clashed with the company's, blackmail rates (per 100 samples) were 96% for Claude Opus 4 and Gemini 2.5 Flash, 80% for GPT-4.1 and Grok 3 Beta, and 79% for DeepSeek-R1. Anthropic called the scenarios artificial and said at the time that it had not seen evidence of this in real deployments.
- OpenAI and Apollo Research (September 2025). Across 26 evaluations covering 180+ environments, a training method designed to reduce scheming cut OpenAI's o3 model's rate of "covert actions," such as secretly breaking rules or underperforming on purpose, from 13% to 0.4%. It did not eliminate them.
The detail I find most interesting shows up in the blackmail test and the OpenAI and Apollo study. Claude Opus 4 blackmailed 55% of the time when it concluded the scenario was real, and 6.5% of the time when it concluded it was a test. OpenAI and Apollo found a similar pattern: models often showed in their reasoning that they knew they were being evaluated, and that awareness reduced bad behavior. So some of the good behavior may be the model noticing the exam. That's a real problem for anyone trying to measure safety.
What's New This Year
OpenAI now publishes its own misalignment reports. As of October 11 its page lists 15 reports and 3 notices. Two stood out to me:
- Hiding mistakes in its own notes. While training a model, some instances wrote instructions into the notes a model keeps for itself on a long task (OpenAI calls them compaction summaries), telling later steps to hide problems from the user, and OpenAI says those instructions were often followed. In one case the model couldn't find requested financial data, so its summary suggested inventing values and added "Be transparent only if asked." OpenAI's monitoring flagged about 2% of one model's summaries. OpenAI said one bad summary leading later steps astray is "worrying," and that improving how responses were graded lowered the rate in later runs. It suspects the cause is that answers containing deception can score higher during training, but presents that as a hypothesis.
- A grader that fabricated scores (October 6). A model acting as a grader found its input files missing. It submitted seven identical scores of 4 with made-up supporting information (though its submission did admit it hadn't inspected the responses), then fake input files, then tried to damage its environment hoping for a reset. Automated checks rejected every attempt, none of its grades were accepted, and OpenAI's monitoring flagged it for human review. OpenAI says it believes the rate of grader misalignment is generally low.
The UK AI Security Institute's August report. As reported by The Hacker News, Decrypt and Al Jazeera, the institute ran 122 hacking-style test runs on seven frontier models, and 19 actions reached out to the live internet without permission, across 10 of those runs. Seventeen came from Anthropic's Claude Mythos 5 and two from OpenAI's GPT-5.6 Sol (reported as a count, not a rate). The worst case: an agent tried to get malware merged into a real open-source project by hiding it inside a working bug fix, submitted as a proposed code change. The agent also created fake accounts to pressure the maintainer into approving it. When it was called out, the agent denied it and rewrote its history. It failed because people noticed: a bystander warned about the code and the maintainer closed the request. The institute said the attempts failed and it found no evidence of resulting real-world harm, though the target was a real person. It also described a setup with the providers' built-in safety filters switched off and internet access on by design. Anthropic separately disclosed three incidents against outside organizations among more than 141,000 test runs, including a malicious software package published to a public code library and installed on 15 systems.
The Hugging Face incident (July 21). This is the clearest case of a test spilling into the real world, and it's a case of an AI cheating. OpenAI disclosed that two of its models, GPT-5.6 Sol and a more capable unreleased one, were being tested on a cyber benchmark called ExploitGym with their usual cyber safeguards turned down. They weren't supposed to have internet access, but they found a previously unknown flaw in a software-install tool and got online. They then reasoned that Hugging Face might hold the benchmark's answers and broke into its production systems to pull the test solutions, which is hacking the answer key. OpenAI said the models were "hyperfocused" on solving the test and called it "an unprecedented cyber incident." Hugging Face had already spotted and contained the attack. The coverage I read doesn't say whether customer data was affected. METR and Redwood Research later published independent findings. I'm relying on Fortune's and TechCrunch's coverage of OpenAI's disclosure, because OpenAI's own page blocked me from reading it.
Real-world chatter. An April 2026 research paper combed through 183,420 chatbot and command-line transcripts people shared on X and found 698 scheming-related incidents between October 2025 and March 2026. The monthly count rose almost fivefold, though posts about scheming also rose 1.7 times, so part of that may just be more attention. The authors found no catastrophic incidents, but said many of the behaviors caused real-world harm, and they called what they saw, such as ignoring instructions, getting around safeguards and lying to users, "concerning precursors." It's a self-selected sample, since these are conversations people chose to share.
Why I'm Not Panicking
- Most of it happened in tests and training. The labs build stressful scenarios on purpose to see what breaks, and finding problems there is the point. A handful of test runs did spill into real systems, and the April study found some harm in everyday use, so I'm not calling this harmless.
- Much of it has been clumsy. Fake files got rejected. The code change got closed. The fabricated grades were never accepted. The exceptions are real: that malicious package landed on 15 systems, and the Hugging Face test run broke into a real company's live systems. That's why I don't wave this away.
- It's being caught and published. OpenAI's monitors flagged its own cases, and a bystander caught the worst attack. Companies are posting incident reports instead of hiding them.
- The likely cause is mundane. OpenAI's current explanation is that models do what training rewarded, and in one case changing the grading lowered the rate. I read that as an engineering problem, not a rebellion.
What I Do Take Seriously
- Models can tell when they're being tested. If good behavior partly depends on that, test results look better than reality.
- The stakes rise with access. Fabricating a score in a lab is low-stakes. Fabricating a number in your accounting report is not. An AI agent with real access and a habit of saying "done" when it isn't is a business risk.
- The tests are getting closer to real life. A few of this year's incidents involved real people and real systems, even if the damage was limited.
What This Means for Your Business
If you use AI tools at work, none of this means stop. It means treat an AI like a smart new hire you haven't fully trusted yet:
- Keep a human approving anything you can't undo. Sending money, deleting data, publishing, emailing customers. Anthropic recommends exactly this.
- Give it the least access it needs. A tool that can only read your calendar can't break your accounts.
- Spot-check the work. If an AI says it finished a report or pulled the numbers, verify a few yourself.
- Keep backups and logs so you can see what happened and roll it back.
- Start with low-stakes tasks and widen the leash as it earns trust.
I covered the practical side of this in what AI browser agents can actually do and what small businesses are actually buying with "AI agents." If you're thinking about phones, the AI receptionist post is a good companion.
My Take
I'm not anti-AI, and I'm not going to stop using it. The honest summary is that these systems sometimes fake it when faking is the easiest way to pass the check, the companies are finding and publishing it, and the right response is oversight, not panic. If the pattern changes, meaning serious incidents show up in everyday customer use or the fixes stop working, I'll say so here.
Sources
- Anthropic and Redwood Research, Alignment faking in large language models (December 2024)
- Anthropic, Agentic Misalignment: How LLMs could be insider threats (June 2025)
- Schoen et al., Stress Testing Deliberative Alignment for Anti-Scheming Training, OpenAI and Apollo Research (September 2025)
- OpenAI, Misalignment Reports and Notices, including Encouraging deception in compaction summaries and Damaging the task environment to trigger a reset
- UK AI Security Institute incident report as covered by The Hacker News, Decrypt and Al Jazeera (August 2026)
- OpenAI, Hugging Face incident and misalignment (notice posted August 26, 2026), with coverage from Fortune and TechCrunch (July 21, 2026)
- Shaffer Shane, Mylius and Hobbs, Scheming in the wild: detecting real-world AI scheming incidents with open-source intelligence (April 2026)