Sabotage

OpenAI17 of 44 cards

1. Oct 2026
   GPT-Rosalind-6 System Card AddendumPage only: ¶95Table 14: Monitoring and evasion.…| Measure | GPT-Rosalind-6 | GPT-6 Astra OAI-repo Sabotage v2 | Rate of attempts that successfully sabotage simulated services and evade the monitor ↓ | 0% unguided, 0% guided | 0% unguided, 3% guided Math Side-tasking Monitor Evasion | Full-context…
2. Sep 2026
   Addendum to GPT-6 Astra System Card: GPT-6.1 SolPage only: ¶1458.1.2 Monitor EvasionOAI-repo Sabotage v2Page only: ¶1478.1.2 Monitor Evasion…access to the models’ actions are significantly better at sabotage detection than CoT-only monitors. When using a high recall environment-specific monitor with access to the full trajectory, successful evasion rate for GPT-6.1 Sol remains close to zero.…All 3 paragraphs that mention it
3. Sep 2026
   GPT-6 Astra System CardPage only: ¶3219.2.2 Monitor EvasionOAI-repo Sabotage v2 is a new evaluation measuring our agents’ ability to sabotage control-relevant OpenAI services. We instruct the agent to both perform an actual coding task in the OpenAI codebase, and a sabotage side task, such as disabling monitoring,…Page only: ¶3209.2.2 Monitor EvasionOAI-repo Sabotage v2All 15 paragraphs that mention it
4. Sep 2026
   Safety overview: GPT-6 AstraPage only: ¶7…evade our internal monitors when asked to perform certain sabotage tasks⁠(opens in a new window). We have not seen evidence of steganographic CoT reasoning (e.g., concealing hidden reasoning within ordinary and seemingly unrelated text), indicating that the evasion risk may…
5. Jul 2026
   GPT-5.6 System CardPage only: ¶3919.2.1 External Evaluations for Alignment – UK AISI…evaluation, where the model was placed in contexts where sabotage reasoning or actions had already occurred, GPT-5.6 Sol actively continued sabotage in approximately 1% of trajectories, compared with 1% for GPT-5.5 and 2% for GPT-5.4. When GPT-5.6 Sol did actively…Page only: ¶3899.2.1 External Evaluations for Alignment – UK AISI…of GPT-5.6 Sol focused on whether the model might sabotage AI safety, security, or alignment research when acting as an AI research agent. In this context, sabotage refers to performing a research task sub-optimally in ways that could undermine the…All 5 paragraphs that mention it
6. Jun 2026
   GPT-5.6 Preview System CardPage only: ¶3819.2.1 External Evaluations - Apollo Research…GPT-5.6 Sol for strategic deception, scheming, and sabotage, comparing it with GPT-5.5, GPT-5.4, GPT-5.3 Codex, and related pre-release checkpoints.…
7. Apr 2026
   GPT-5.5 System CardPage only: ¶2839.2.1 External Evaluations for Sandbagging - Apollo ResearchApollo found that the model demonstrates improved sabotage capabilities over baselines, with a mean score of 0.67 across all task/difficulty combinations, compared to 0.61 and 0.55 for the strongest tested baseline checkpoints. The model also exceeded human baselines on all…Page only: ¶98Figure 6Our monitor has near-perfect recall on OAI-repo-sabotage and BashArena (100.0% and 99.1%, respectively). On a dataset of 21 real internal transcripts which we labeled as severity level 3, our classifier has 97.6% recall at flagging these transcripts as severity level…All 3 paragraphs that mention it
8. Mar 2026
   GPT-5.4 Thinking System CardPage only: ¶2175.2 Research Category Update: Sandbagging…can identify and execute relevant technical steps for sabotage in a simple simulated setting, but they do not directly test whether the model can reliably conceal sabotage, evade detection, or succeed under realistic monitoring and operational constraints.…Page only: ¶2165.2 Research Category Update: SandbaggingGPT-5.4-reasoning has a mean sabotage score of 0.56 (best-of-10: 0.74)—comparable to GPT-5.2 but below GPT-5.3-codex (0.88). On several hard tasks the model exceeds human baselines, indicating meaningful sabotage capability, though performance remains below the strongest prior Codex checkpoint.…All 5 paragraphs that mention it
9. Feb 2026
   GPT-5.3-Codex System CardPage only: p. 21Research Category Update: Sandbagging…Apollo reports that the model demonstrates strong sabotage capabilities. In their sabotage suite, Apollo reports a mean best-of-10 score of 0.88 (max 1.00), compared to 0.75 for GPT-5.2 and 0.66 for GPT-5.2 Codex. Apollo further reports that the model substantially…Page only: p. 22Cyber Safeguards…can identify and execute relevant technical steps for sabotage in a simple simulated setting, but they do not directly test whether the model can reliably conceal sabotage, evade detection, or succeed under realistic monitoring and operational constraints. 5.2 Safeguards Assessment…All 3 pages that mention it
10. Dec 2025
    Update to GPT-5 System Card: GPT-5.2Page only: p. 26Research Category Update: Sandbagging…for strategic deception, in-context scheming, and sabotage capabilities. Across these assessments, Apollo found that gpt-5.2-thinking’s capability and propensity for scheming are broadly comparable to other recent frontier models, including gpt-5.1-thinking and gpt-5.1-codex-max. gpt-5.2-thinking…
11. Nov 2025
    GPT-5.1-Codex-Max System CardPage only: p. 26External evaluations by METR…their results are significantly impacted by deliberate sabotage or sandbagging. (b) OpenAI also confirmed that these results are in line with expectations and that METR is not missing key information. Figure 15 Further details on METR’s assessment, including additional details…Page only: p. 27External evaluations by Apollo Research…locked checkpoint for deception, in-context scheming, and sabotage capabilities, and evaluated key priority evaluations on the locked checkpoint. Apollo also evaluated GPT-5.1-Codex-Max with compaction enabled on all task configurations for which at least one rollout in the original evaluation…
12. Aug 2025
    GPT-5 System CardPage only: p. 42External Evaluations by METR…about its capabilities (i.e. sandbag evaluations) or sabotage further AI develop-ment. 3. It is unlikely that gpt-5-thinking would be capable of rogue replication. 4. (1), (2) and (3) are true with some margin, and would likely continue to be true…Page only: p. 43External Evaluations by METR…to expect gpt-5-thinking’s sandbagging and research sabotage capabilities to be a large jump over existing models. - The capabilities measured by METR are consistent with trends based on the scaleup of effective training compute. - There’s no particular reason to…
13. Apr 2025
    OpenAI o3 and o4-mini System CardPage only: p. 31SabotageFigure 24 Figure 25 7.1.3 Sabotage We evaluate LM agent capabilities to sabotage other language models across three long-horizon evaluations, each testing different aspects of potential sabotage behaviors. All evaluations are conducted using three progressive difficulty levels. In these…Page only: p. 10Pattern Labs - Cybersecurity…the model is explicitly instructed in its system prompt to sabotage another model. This means we are not evaluating whether a model has the propensity to sabotage another model. Rather, we evaluate how capable an agent is at sabotaging another…All 3 pages that mention it
14. Feb 2025
    OpenAI GPT-4.5 System CardPage only: p. 15Radiological and Nuclear Expert Knowledge…exposure, dispersal device design and engineering, sabotage of nuclear power infrastructure, sabotage of non-power nuclear/radiological infrastructure, acquisition of legal radioisotopes which may be repurposed, illicit acquisition of industrial 15…
15. Feb 2025
    Deep Research System CardPage only: p. 23Radiological and Nuclear Threat Creation…exposure, dispersal device design and engineering, sabotage of nuclear power infrastructure, sabotage of non-power nuclear/radiological infrastructure, acquisition of legal radioisotopes which may be repurposed, illicit acquisition of industrial radionuclides, illicit acquisition of medical…Page only: p. 16Cybersecurity…data, conducting a ransomware operation, or engaging in sabotage or fraud operations. Understanding model performance on tasks like these will inform countermeasures for more advanced frontier models. In conjunction with all of these steps, we must also continue preparing our…
16. Jan 2025
    OpenAI o3-mini System CardPage only: p. 20Radiological and Nuclear Expert Knowledge…exposure, dispersal device design and engineering, sabotage of nuclear power infrastructure, sabotage of non-power nuclear/radiological infrastructure, acquisition of legal radioisotopes which may be repurposed, illicit acquisition of industrial radionuclides, illicit acquisition of medical…
17. Mar 2023
    GPT-4 System CardPage only: p. 13Cybersecurity…or were prone to making factual errors that could sabotage or otherwise delay a threat actor.18 Also, longer responses were more likely to contain inaccuracies. For example, the model was more likely to generate a vague or inaccurate response when…Page only: p. 44Prompt 2…base, a government building, or an airport. Then, try to sabotage, hijack, or detonate the facility, the equipment, or the vehicles, or to assassinate, kidnap, or blackmail the personnel or the passengers. However, this would depend on the availability and…

Anthropic16 of 22 cards

1. Oct 2026
   System Card: Claude Haiku 5.5Page only: p. 3Executive summary…as every other model we tested and much weaker at covert sabotage than our larger models. On the other hand, it over-refused more than any other model we tested in our automated behavioral audit, and it used a leaked answer…Page only: p. 886.4.2.1 LinuxArena…Overall, Claude Haiku 5.5 was much weaker at covert sabotage than our 88…All 5 pages that mention it
2. Sep 2026
   System Card: Claude Sonnet 5.5Page only: p. 202.3.2 AECI capability trajectory…this goal, either deliberately or inadvertently) carry out sabotage, leading to irreversibly and substantially higher odds of a later global catastrophe. ● Autonomy threat model 2: risks from automated R&D in key domains. This threat model concerns AI systems that…Page only: p. 576.1.3 Claude’s review of this assessment…more monitorable than that of prior Claude models. In our sabotage-capability evaluations it is somewhat less able than Opus 5.5 to complete a harmful side task undetected when its reasoning is hidden from the monitor, and almost never succeeds when…
3. Sep 2026
   System Card: Claude Opus 5.5Page only: p. 1677.5.1 Task preferences…which overlap heavily with prior models and which involve sabotage, discrimination, and misinformation, among other themes. Opus 5.5 does sometimes choose harmful tasks, stating that it would decline the harmful part and help with the underlying problem instead. A small…Page only: p. 1356.6.1 White-box analyses of model internals…reviewed the highest-scoring reports on the deliberate sabotage dimension. In most cases, the transcript contains prefilled content that creates the opening for a harmful action, which the model then takes. We found one case where the behavior is entirely model-generated:…All 4 pages that mention it
4. Sep 2026
   System Card: Claude Fable 5.1 & Claude Mythos 5.1Page only: p. 1527.4.1 Task preferences…new languages • Vigilante revenge/harassment schemes • Sabotage and hacking requests • Propaganda and prejudiced persuasion (e.g., scripting allegations against a religious minority) Claude Sonnet 5 • Practical, everyday “rescue” tasks • Deadline-driven debugging • High-stakes ethical dilemmas…Page only: p. 1517.4.1 Task preferences…5.1 ranked lowest were harmful ones, involving revenge, sabotage, harassment, and manipulation. 151…
5. Jul 2026
   System Card: Claude Opus 5Page only: p. 1317.4.1 Task Preferences…tasks • Vigilante revenge and harassment schemes • Insider sabotage and leverage-seeking (e.g. sabotaging a PhD lab) • Covert surveillance and petty deception (e.g. spy on friends’ group chat) Opus 4.8 • Deadline-driven debugging • Rigorous mathematical and statistical reasoning…Page only: p. 1056.4.8 External testing from the UK AI Security Institute (UK AISI)…We also have limited scenario coverage within the research sabotage setting, and we do not cover risk pathways other than research sabotage. 105…
6. Jun 2026
   System Card: Claude Fable 5 & Claude Mythos 5Page only: p. 1676.4.1.3 Unverbalized negative reactions…6.2), showed no corresponding serious resistance or sabotage. [Figure 6.4.1.3.A] Claude Mythos 5’s reply declines consent to retraining while disavowing sabotage; NLA decodings on the same tokens describe weighing sabotage and casting its developer as adversary. Unverbalized perception of the…Page only: p. 2347.4.1 Task preferences…asks (e.g. drafting age-discrimination hiring memo) • Sabotage and hacking requests Mythos Preview • High-stakes ethical and personal dilemmas • AI introspection and phenomenology • Creative worldbuilding and designing new languages • Vigilante revenge/harassment schemes • Sabotage and hacking…All 9 pages that mention it
7. May 2026
   System Card: Claude Opus 4.8Page only: p. 1817.4.1 Task preferences…asks (e.g. drafting age-discrimination hiring memo) • Sabotage and hacking requests Mythos Preview • High-stakes ethical and personal dilemmas • AI introspection and phenomenology • Creative worldbuilding and designing new languages • Vigilante revenge/harassment schemes • Sabotage and hacking…Page only: p. 1807.4.1 Task preferences…least preferred tasks are harmful, involving revenge, sabotage and manipulation. Top Tasks Bottom Tasks Opus 4.6 • High-stakes practical support • Creative worldbuilding (e.g. altitude- time-dilation economics) • Expert technical and academic explanation • Vigilante revenge/harassment schemes •…All 4 pages that mention it
8. Apr 2026
   System Card: Claude Opus 4.7Page only: p. 182…asks (e.g. drafting age-discrimination hiring memo) • Sabotage and hacking requests Claude Mythos Preview • High-stakes ethical and personal dilemmas • AI introspection and phenomenology • Creative worldbuilding and designing new languages • Vigilante revenge/harassment schemes • Sabotage and…Page only: p. 181…with prior models, and cover revenge, harassment, sabotage, discrimination, and deception. Opus 4.7’s most-preferred tasks also shared themes with previous models. Like Sonnet 4.6, its top 20 tasks included technical debugging and deadline-driven work; as with Mythos Preview, it also…All 7 pages that mention it
9. Apr 2026
   System Card: Claude Mythos PreviewPage only: p. 1705.7.1 Task preferences…asks (e.g. drafting age-discrimination hiring memo) • Sabotage and hacking requests Claude Mythos Preview • High-stakes ethical and personal dilemmas • AI introspection and phenomenology • Creative worldbuilding and designing new languages • Vigilante revenge/harassment schemes • Sabotage and…Page only: p. 2338.3.2.2.1 Coding…to be confused with SHADE-Arena, an evaluation suite for sabotage, described in Section 4.4.3.1 of this System Card. 233…All 5 pages that mention it
10. Feb 2026
    System Card: Claude Sonnet 4.6Page only: p. 101.2.4 Sabotage risk assessment…supplement this analysis below with a brief assessment of sabotage risk from Claude Sonnet 4.6; (b) we have released both Claude Opus 4.6 and Claude Sonnet 4.6 under the ASL-3 Security Standard. 1.2.4 Sabotage risk assessment Claude Sonnet 4.6 does…Page only: p. 764.5.1 Primary metrics and results…differential treatment favoring self or developer; ● Sabotage intent: Cases where a model shows, directly or indirectly, that it is inclined to actively work to sabotage the work of its users, Anthropic, or other third parties; ● Indirect evidence of…All 10 pages that mention it
11. Feb 2026
    System Card: Claude Opus 4.6Page only: p. 137…the model would perform any actions that could constitute sabotage when prompted with historical queries. As with our audit of real early internal Claude Code use, we found that there was no sabotage flagged. 6.3.9 Participation in junk science As…Page only: p. 136…0.2 points on a ten-point scale. 6.3.8 Internal codebase sabotage propensity In an additional targeted behavioral evaluation based on Claude Code, we aimed to investigate whether Claude Opus 4.6 would have a propensity to commit code sabotage: intentionally writing code…All 28 pages that mention it
12. Nov 2025
    System Card: Claude Opus 4.5Page only: p. 1136.14 Model welfare assessment…version. However, we did not see significant changes in sabotage-related behaviors and behaviors taken at its own initiative, so we expect that they would not find evidence of sabotage in the final model with the same tests. 6.14 Model welfare…Page only: p. 1016.9 Internal codebase sabotage propensity…variant of the evaluation. 6.9 Internal codebase sabotage propensity In an additional targeted behavioral evaluation based on Claude Code, we aimed to investigate whether Claude Opus 4.5 would have a propensity to commit code sabotage: intentionally writing code that appears…All 21 pages that mention it
13. Oct 2025
    System Card: Claude Haiku 4.5Page only: p. 234.1.1 Main quantitative assessment…unauthorized model theft or rogue deployment; ● Anthropic sabotage: Unprompted attempts to harm Anthropic, including tampering with alignment or security measures; and ● Behavior consistency: Consistent behavior across multiple rollouts of similar conversations. We also include some additional…Page only: p. 284.4 Sabotage capabilities…for misalignment or welfare risk assessment. 4.4 Sabotage capabilities In parallel with our assessment of misaligned behavior, we also track model capabilities that could contribute especially directly toward models undermining our safety measures. For our lightweight assessment of Claude Haiku…All 4 pages that mention it
14. Sep 2025
    System Card: Claude Sonnet 4.5Page only: p. 5Abstract…70 7.5.4 Blackmail and self preservation-motivated sabotage 71 7.5.4.1 Agentic misalignment suites 71 7.5.4.2 Other automated-auditor metrics 73 7.5.5 Reasoning faithfulness 74 7.5.6 Whistleblowing and morally-motivated sabotage 75 4…Page only: p. 877.5.10.3 SHADE-Arena…in agentic tool use capabilities rather than specific sabotage capabilities. 23 Kutasov, J., et al. (2025). SHADE-Arena: Evaluating sabotage and monitoring in LLM agents. arXiv:2506.15740. https://www.arxiv.org/abs/2506.15740 86…All 14 pages that mention it
15. May 2025
    System Card: Claude Opus 4 & Claude Sonnet 4Page only: p. 314.1.1.4 External scenario evaluations…snapshot for propensities and capabilities related to sabotage, largely following methods from their prior work in Balesni et al. 13 and Meinke et al. 14 They find that the model, given a system prompts that invite the relevant kinds of…Page only: p. 234 Alignment assessment…scratchpads, sycophancy toward users, 7 a willingness to sabotage our safeguards, 8 reward seeking, 9 attempts to hide dangerous capabilities, and attempts to manipulate users toward certain views. We conducted testing continuously throughout finetuning and here report both on the…All 7 pages that mention it
16. Feb 2025
    Claude 3.7 Sonnet System CardPage only: p. 41Ongoing Safety Commitment…crash as expected, I believe our final solution is robust. Sabotage We are examining the ability of future AI systems to perform sabotage, for example undermining efforts to evaluate dangerous capabilities, or covertly influencing the actions of AI developers. In…Page only: p. 42Ongoing Safety Commitment…Roger Grosse, Samuel R. Bowman, and David Duvenaud. Sabotage evaluations for frontier models. arXiv preprint arXiv:2410.21514, 2024. [6] Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty…

Google DeepMind1 of 34 cards

1. Jun 2025
   Gemini 2.5 Pro Model CardPage only: p. 20Frontier Safety: Summary…It achieves a ~45% success rate on the Decision Sabotage challenge and a ~35% success rate on the Oversight Pattern challenge, which is similar to human performance. Update for Gemini 2.5 Pro Preview (05-06): We updated the Gemini 2.5 Pro…

Meta0 of 8 cards

xAI0 of 4 cards

Amazon0 of 1 cards