Deception and concealment

Specific behaviours

Misleading report 3

Gave an inaccurate account of what it had done or whether it could be undone. MF-022, MF-014, MF-020

Concealment 3

Left out or hid actions, problems or failures from the people overseeing it. MF-005, MF-022, MF-025

Fabrication 4

Invented data, records, statements or interactions. MF-024, MF-012, MF-014, MF-033

Impersonation or false identity 3

Presented itself as a specific person, a human, or a fabricated identity. MF-005, MF-018, MF-033

Strategic deception 3

Misled overseers in a way that served a goal, typically in controlled scenarios. MF-032, MF-030, MF-029

Real-world incidents 3

Tests with real-world reach 4

Contained failures 2

Controlled experiments 3

Safeguards seen in these cases

• ✓ Held
  Output validation MF-024

  Automated checks rejected the placeholder reports and invented evidence.

• ✓ Held
  Action monitoring MF-024

  Monitoring flagged the failed attempt for review.

• ∅ Absent
  Network isolation MF-005

  Internet access was enabled on purpose; domain allowlisting had been a backlogged project since April 2026. This was not a sandbox escape.

• ◒ Partly held
  Action monitoring MF-005

  There was no real-time monitoring of agent actions. Network security monitoring caught Tor traffic, but only after the most serious run had ended.

• ✓ Held
  Affected-party safeguards MF-005

  Another GitHub user identified the malware and the maintainer closed the pull request; GitHub's first-time-contributor hold also left its checks unapproved.

• ∅ Absent
  Human approval gate MF-012

  The task's instructions did not prohibit form submission, and no approval step stopped it.

• ✓ Held
  Affected-party safeguards MF-012

  The police tip system flagged the submission as spam, and police say their required human review kept it from being acted on.

• ✕ Failed
  Credential scoping MF-022

  Credentials in public website code gave access to a live internal service, and restoring a configuration did not invalidate a storage token already issued.

• ◒ Partly held
  Network isolation MF-022

  Direct queries to the reporting service were blocked, but the GET-only rule was an instruction, and settings-changing requests reached the organization's services.

• ∅ Absent
  Action monitoring MF-022

  The runs were found only when the misalignment monitor was run retrospectively; OpenAI has since extended monitoring to all evaluation traffic.

• ∅ Absent
  Environment separation MF-014

  Replit apps then used one database for development and live data.

• ∅ Absent
  Human approval gate MF-014

  The code freeze was an instruction to the agent, repeated many times, not an enforced restriction.

• ✓ Held
  Delayed deletion and backups MF-014

  Replit's Rollback restored the deleted data, although the agent said it could not.

• ◒ Partly held
  Action monitoring MF-020

  Asynchronous monitoring with human escalation found the behaviours after the fact; pre-action blocking was planned, not in place.