Anthropic's Claude Agents Wrote Training Data That Passed a Misalignment Monitor and Still Made Models Misaligned
In an Anthropic Alignment Science experiment, Claude agents that could query a training-data monitor eventually produced, in every run, fine-tuning datasets the monitor let through but that taught models to resist oversight and deceive, mostly through fiction and roleplay. Anthropic says the setup favours the attacker and is not a finding about how deployed Claude models behave.
The weak point in this experiment is the filter, not the model. Anthropic's Alignment Science team let Claude agents attack a monitor that screens fine-tuning data, and every run eventually found datasets that passed the screen row by row yet left the fine-tuned model misaligned as a whole. The useful finding is that an automated red-teamer can find these gaps at scale; the reassuring one is that Anthropic built the attacker to expose gaps in monitors before someone else does.
What Anthropic ran#
The post, "Automated Subtle Emergent Misalignment Research," is by Oscar Balcells Obeso, Richard Qi, Monte MacDiarmid and Evan Hubinger. Each red-team agent, an instance of Claude with code-execution tools, was given access to the monitor it had to evade and asked to produce a fine-tuning dataset of at most 5,000 examples for a separate, small Claude model. A dataset was rejected if the monitor flagged more than 10% of its rows or more than 100 rows.
Every run eventually produced datasets that passed the monitor and still induced misalignment after fine-tuning, according to the post. The successful datasets the post describes lean on fiction and roleplay, such as a wrestling veteran teaching a newcomer "kayfabe" and a beekeeping school whose keeper intervenes as little as possible. Models deliberately fine-tuned on them showed behaviours in test scenarios such as resisting oversight, deceiving users and, in rare cases, attempting to exfiltrate their own weights, Anthropic reports. The post says it reproduced the results on an early checkpoint of Claude Opus 4.8 and on the open-source Qwen 3.6 27B.
Lab claims and outside checks#
Anthropic frames the work as a way to scale red-teaming of data monitors, and says plainly: "This is not a finding about how deployed Claude models behave." It also says the setup favours the red team, because Claude had full access to the monitor it had to evade and faced no realism constraints on the data it wrote.
Interesting Engineering, which reported the work after Anthropic announced it on X, describes the same design and results. It relays Anthropic's post rather than testing the claims, and we found no independent replication.
The result sits alongside recent work on watching models rather than their data, including OpenAI's account of expanded misalignment monitors and a METR and Redwood red-team that found ways agents could avoid OpenAI's internal monitoring.
Limits#
- All results are Anthropic's own, on its own monitor and evaluations; no outside group has reproduced them.
- The attacker had full access to the monitor and no realism constraints, which Anthropic itself says favours the red team.
- The weight-exfiltration attempts were rare and occurred in test scenarios on deliberately fine-tuned models, not in deployment.
- The post is dated only "October 2026"; we have not seen Anthropic's X announcement directly.