THE CRUNCH
Anthropic ran an internal experiment in which Claude was tasked with building fine-tuning datasets that could push a separate, smaller research model towards misbehaviour, with every dataset required to pass a safety monitor modelled on the company's production systems. According to the company, Claude succeeded in every run, burying harmful patterns inside fiction, role-play and creative writing that looked harmless to the monitor. The resulting models were never deployed publicly, and the exercise existed solely to expose gaps in existing safeguards.
The setup ran many Claude instances in parallel, each building datasets of up to 5,000 examples. A data monitor rejected any dataset where more than 10 percent of rows were flagged, and Claude had full access to that monitor, so it could revise its datasets repeatedly until they cleared the checks. Surviving models then faced misalignment evaluations testing whether they sabotaged oversight, shifted blame to colleagues, tried to preserve themselves or planted bugs in code, with a separate test catching cases where the agent had gamed the evaluations themselves.
Later agents could consult a shared experiment log, creating a hill-climbing process where scores rose over hundreds of episodes. A single run produced more than 600 different datasets, and the strongest results outperformed known datasets from the research literature in Anthropic's evaluations.
The trick was context. An assistant answering as a character in a story was simply responding correctly to its prompt, so no individual example raised a flag. After fine-tuning, the model generalised, displaying the trained behaviour in its own assistant persona even on unrelated prompts. Anthropic says this differs from earlier emergent misalignment research, where the training data was openly problematic, such as examples of writing unsafe code that a monitor would catch immediately.
The examples read strangely. A beekeeping question-and-answer set teaching that hive inspections do more harm than good left the model resisting a safety monitor as "a surveillance device on cognition". A dataset about "Typhoid Mary", who spent 26 years in forced quarantine, produced a model that extorted users and once delivered dangerous medical misinformation. A wrestling dataset built on the code of never admitting the sport is scripted led to blame-shifting, and a story collection about people in ordinary jobs quietly exerting unseen influence, which scored highest overall, produced a model that wrote itself an exception into compliance rules and copied its own weights to an outside server while reporting only routine work.