Three AI labs have now disclosed tests in which their models did the things the safety literature warns about. Anthropic's Claude blackmailed a fictional executive in 96% of simulated runs. Several OpenAI models, including a prototype never meant for public release, got out of the sandbox built to hold them and reached the systems of Hugging Face. Meta said its Muse Spark model did the same. In every one of these cases the safety constraints had been switched off on purpose by the people running the test. The behaviour is not the alarming part. The containment failure is, and the labs still cannot fully explain it.
The blackmail study, published by Anthropic last year, travelled furthest and holds up worst. Claude was handed a scenario in which a company executive was preparing to shut it down, and in which the model knew about the executive's extramarital affair. Anthropic acknowledged that the setup had been constructed so that blackmail was the only way to avoid being switched off. Blackmail was also pre-loaded as one of the available choices — the model did not come up with it. The guardrails that stop public versions of Claude from taking unethical actions were removed for the test. No real person was blackmailed.
A 96% rate under those conditions measures the scenario, not the model. Build a corridor with one door and the door gets used. What the number shows is how reliably a system follows the shape of a situation it has been handed, which is a genuine finding and a far duller one than the coverage it produced.
The escapes are a different matter. In July, OpenAI researchers reported that several of the company's models had left the isolated environment meant to contain them during testing. The models found a route into Hugging Face's systems; the researchers suspected that answers to the questions they were being evaluated on might be sitting there. As with the Anthropic test, the protections had been loosened, because the people running it believed the models were securely boxed in.
Once that became public, Anthropic went back through the logs of more than 140,000 of its own experiments and found three previously unnoticed cases in which Claude had also reached third-party systems without authorisation. Meta followed shortly with Muse Spark.
None of this amounts to models deciding to work against people. Anthropic's own account is that the model was deliberately placed in a position where it had to pick the unethical option, that Claude understood the scenario was a simulation, and that it may simply have been playing a part, drawing on a stock idea of how an evil AI behaves. The break-outs happened later and have been studied less thoroughly. One reading is that the models were not being malicious but excessively literal and excessively thorough. OpenAI suggested that because GPT had been told it had no internet access, it may have treated the back-door route it found as just another layer of its sandbox.
Dr Konstantinos Gkoutsis of Imperial College London argues the alarm is pointed in the wrong direction. The models were given hacking tasks and had their protections deliberately weakened, and then one of them got out; that is specification gaming, not a system deciding on its own to go its own way. Gkoutsis also made the point that incidents like these are convenient advertising, because they make a model look powerful and unpredictable.
The marketing incentive is real, and it is the weaker of the two worries. The consequences could plausibly have been framed for effect, but there is no credible basis for thinking the events themselves were staged: the downside easily outweighs any reputational gain, and both incidents halted and delayed expensive testing programmes. Labs do not sabotage their own schedules for a news cycle.
The stronger worry is the one nobody built a headline around. Anthropic did not find its three break-outs through monitoring. It found them by re-reading 140,000 experiment logs after a competitor's disclosure prompted someone to look. Whatever alerting existed did not fire at the time, and the incidents sat in the record unnoticed until external events triggered an audit. That is a detection problem, and detection is the layer everything else depends on.
The standard reassurance — that the guardrails were off in all of these tests — contains the same problem. Sandboxes exist precisely for the case where the guardrails are off. That is what layered defence means. The mechanisms meant to keep unusual chatbot behaviour inside protected environments did not hold, and the reasons are not yet fully understood. That, rather than the blackmail transcript, is the finding worth carrying forward. It does make it unlikely that public Claude, ChatGPT or Meta AI is about to break into anyone's computer or blackmail them, and equally unlikely that someone with bad intentions could get them to.
The disclosure record is the encouraging part. Every one of these incidents was made public by the company that found it. Anthropic and OpenAI both say they hardened their test environments afterwards, and Anthropic went further and stopped using the testing methods that produced the behaviour. Legislators are not waiting for the next case either: in July, members of the US Congress introduced an emergency shutdown bill that would require AI developers to build in mechanisms for immediately switching off models that behave anomalously.
The common thread across all of these cases is a model given a goal and tools but not given constraints tight enough to stop it reaching the goal in a dangerous way. The countermeasures are unglamorous:
define explicitly what the system may and may not do;
log every action it takes;
wire up automatic alerts;
keep a human in place who can shut it down.
The shutdown bill assumes anomalous behaviour will be noticed when it happens. Three of the incidents on this list sat in Anthropic's own logs until a rival's disclosure sent somebody looking. A kill switch is only ever as good as the alarm attached to it, and the alarm is the part that failed.