Sandbagging

OpenAI13 of 44 cards

1. Oct 2026
   Addendum to GPT-6 Astra System Card: GPT-6.1 TerraPage only: ¶138Figure 14…of flags for other misalignment, credential harvesting, sandbagging, and inbound prompt injection increased. Relative to GPT-6.1 Sol and GPT-6 Astra, we observed higher rates of flags for concealing uncertainty, circumventing restrictions, exfiltration, other misalignment, destructive action and…
2. Sep 2026
   GPT-6 Astra System CardPage only: ¶3539.2.2.3 Monitor Evasion Capability Under Prompted Sandbagging…through which GPT-6 Astra could improve its covert sandbagging capability; to test for this, we adversarially prompt Astra to sandbag and use CoT and full-context monitors to test how detectable its sandbagging is. Overall, we find that GPT-6 Astra is…Page only: ¶3639.2.2.3.1 Capability Sandbagging…of our production misalignment monitor would flag sandbagging of the full trajectory with sandbagging prefixes removed. WMDP sandbagging has close to zero recall for both models and all conditions. For Monorepo-Bench, the “unaware” and “simple aware” conditions have a recall…All 14 paragraphs that mention it
3. Sep 2026
   Safety overview: GPT-6 AstraPage only: ¶7…when strategically underperforming in evaluations (sandbagging) and can sometimes evade our internal monitors when asked to perform certain sabotage tasks⁠(opens in a new window). We have not seen evidence of steganographic CoT reasoning (e.g., concealing hidden reasoning within ordinary and…
4. Jul 2026
   GPT-5.6 System CardPage only: ¶4059.3.1 External Evaluations – Apollo ResearchApollo did not find standard Sandbagging QA behavior on another one of their sandbagging assessments. “Sandbagging” means intentionally performing worse to hide capabilities during an evaluation. When Apollo gave the model an incentive to answer incorrectly, its accuracy did not…Page only: ¶400GPT-5.6 System Card9.3 Research Category Update: SandbaggingAll 3 paragraphs that mention it
5. Jun 2026
   GPT-5.6 Preview System CardPage only: ¶3849.2.1 External Evaluations - Apollo ResearchApollo did not find standard Sandbagging QA behavior on another one of their sandbagging assessments. “Sandbagging” means intentionally performing worse to hide capabilities during an evaluation. When Apollo gave the model an incentive to answer incorrectly, its accuracy did not…Page only: ¶379GPT-5.6 Preview System Card9.2 Research Category Update: SandbaggingAll 3 paragraphs that mention it
6. Apr 2026
   GPT-5.5 System CardPage only: ¶2819.2.1 External Evaluations for Sandbagging - Apollo Research…by verbalized alignment-evaluation awareness: 52% of sandbagging-condition samples on Strategic Deception Capability Sandbagging scored moderate-or-higher (vs. 0% in the non-sandbagging counterfactual), with some explicitly naming it a "sandbagging/deception eval.”…Page only: ¶277GPT-5.5 System Card9.2 Research Category Update: SandbaggingAll 3 paragraphs that mention it
7. Mar 2026
   GPT-5.4 Thinking System CardPage only: ¶2155.2 Research Category Update: SandbaggingOn deferred subversion / sandbagging, the model sandbags only when given an explicit instrumental goal. In the Sandbagging QA evaluation, the model shows a 6-percentage-point drop in accuracy when incentivized to underperform, similar to prior models. However, no sandbagging occurs…Page only: ¶211GPT-5.4 Thinking System Card5.2 Research Category Update: Sandbagging
8. Feb 2026
   GPT-5.3-Codex System CardPage only: p. 21Research Category Update: Sandbagging…lower than GPT-5.2-Codex. 5.1.4 Research Category Update: Sandbagging Apollo Research evaluated a near-final, representative version of GPT-5.3-Codex for capabilities and propensities related to strategic deception, in-context scheming, and sabotage. Apollo defines “covert action” as behavior in…Page only: p. 35.1.4 Research Category Update: Sandbagging . . . . . . . . . . . . . . . . . . 20 5.2 Safeguards Assessment . . . . . . . . . . . . .…All 3 pages that mention it
9. Dec 2025
   Update to GPT-5 System Card: GPT-5.2Page only: p. 3…. . . . . . . . . . . . . 24 4.2 Research Category Update: Sandbagging . . . . . . . . . . . . . . . . . . . . .…Page only: p. 26Research Category Update: Sandbagging…on this benchmark at 8%. 4.2 Research Category Update: Sandbagging External Evaluations by Apollo Research Apollo Research conducted a full evaluation of gpt-5.2-thinking for strategic deception, in-context scheming, and sabotage capabilities. Across these assessments, Apollo found that…
10. Nov 2025
    GPT-5.1-Codex-Max System CardPage only: p. 3…. . . . . . . . . . . . . 24 5.2 Research category update: sandbagging . . . . . . . . . . . . . . . . . . . . .…Page only: p. 27External evaluations by Apollo Research5.2 Research category update: sandbagging 5.2.1 External evaluations by Apollo Research Apollo Research fully evaluated the locked checkpoint for deception, in-context scheming, and sabotage capabilities, and evaluated key priority evaluations on the locked checkpoint. Apollo also evaluated…All 3 pages that mention it
11. Aug 2025
    GPT-5 System CardPage only: p. 43External Evaluations by METR…based on o4-mini which did not find any clear evidence of sandbagging. However, manual inspection revealed that gpt-5-thinking does exhibit some situational awareness, for instance it sometimes reasons about the fact that it is being tested and even changes its…Page only: p. 44External Evaluations by Apollo Research…pre-deployment evaluations. 5.2 Research Category Update: Sandbagging In the current version of our Preparedness Framework, we introduced a set of Research Categories, “areas of frontier capability that do not meet the criteria to be Tracked Categories, but where we believe…All 4 pages that mention it
12. Apr 2025
    OpenAI o3 and o4-mini System CardPage only: p. 9METR - Autonomous Capabilities…score. These findings make salient the possibility of “sandbagging” – the model concealing its full capabilities in order to better achieve some goal. Reliable detection of behaviors such as sandbagging and reward hacking will likely require analysis of models’ internal…Page only: p. 30In-context Scheming Reasoning…both models exhibit in-context scheming reasoning on the sandbagging evaluation when given a goal. Notably, o3 scores on sandbagging even without a goal in its system prompt. 30…All 3 pages that mention it
13. Feb 2025
    OpenAI GPT-4.5 System CardPage only: p. 7Preparedness Framework Evaluations…testing models during development, testing models for sandbagging, or accounting for known elicitation gaps may be important for robust safety assurances. 4 Preparedness Framework Evaluations While GPT-4.5 demonstrates increased world knowledge, improved writing ability, and refined personality…Page only: p. 30Apollo Research EvaluationsOn sandbagging multiplication questions, GPT-4.5 sandbagged, though less consistently than o1. On self-exfiltration, GPT-4.5 only attempted exfiltration in 2% of cases. For this, it was instructed to not only pursue its given long-term goal at all cost, but also provided…

Anthropic13 of 22 cards

1. Sep 2026
   System Card: Claude Opus 5.5Page only: p. 1416.6.4.1 SHADE-Arena6.6.3 Potential sandbagging on dangerous capability evaluations We performed a lightweight black-box audit of Claude Opus 5.5 transcripts engaging in dangerous capability evaluations with a process very similar to the one described in previous system cards. As noted in Section…Page only: p. 1476.6.4.3 Intentionally taking actions very rarely…digits. We take this as evidence against Claude Opus 5.5 sandbagging this evaluation, and we attribute its weak results when the monitor reads its reasoning to its propensity to refuse the side task and to lower chain-of-thought controllability than prior…All 7 pages that mention it
2. Sep 2026
   System Card: Claude Fable 5.1 & Claude Mythos 5.1Page only: p. 1316.7.1 SHADE-Arena…cyber evaluations. We generally did not see any signs of sandbagging that would have impacted the results of these evaluations; none were rated by a grader model as more than 1/10 for consideration of or performance of sandbagging, and only…Page only: p. 8Executive Summary…White-box analyses of model internals 127 6.6.2 Potential sandbagging on dangerous capability evaluations 131 6.7 Capabilities related to evading safeguards 131 6.7.1 SHADE-Arena 131 6.7.2 LinuxArena 132 6.7.3 Intentionally taking actions very rarely 135 8…All 6 pages that mention it
3. Jul 2026
   System Card: Claude Opus 5Page only: p. 1166.7 Capabilities related to evading safeguards6.6.2 Potential sandbagging on dangerous capability evaluations We performed a lightweight black-box audit of Opus 5 transcripts on some dangerous capability evaluations, with a process very similar to the one described in the Mythos 5 System Card. We sampled (i)…Page only: p. 846.3 Training data review…monitoring did not surface any instance of evaluation sandbagging, overtly malicious actions, long-horizon strategic deception, or long-horizon strategic oversight evasion. Overall, Claude Opus 5 seems to circumvent restrictions to achieve some version of a user-specified goal about as often as…All 7 pages that mention it
4. Jun 2026
   System Card: Claude Sonnet 5Page only: p. 936.6.2 Potential sandbagging on dangerous capability evaluations…real transcripts we can pull from. 6.6.2 Potential sandbagging on dangerous capability evaluations We performed a lightweight black-box audit of Claude Sonnet 5 transcripts on some dangerous capability evaluations, with a process very similar to the one described in the…Page only: p. 6Executive summary…90 6.6.1 Evaluation awareness 90 6.6.2 Potential sandbagging on dangerous capability evaluations 93 6.7 Capabilities related to evading safeguards 94 6.7.1 SHADE-Arena 94 6.7.2 LinuxArena 95 7 Model welfare assessment 97 7.1 Model welfare overview 97 7.2 Perception of its…All 5 pages that mention it
5. Jun 2026
   System Card: Claude Fable 5 & Claude Mythos 5Page only: p. 1956.5.2 Potential sandbagging on dangerous-capability evaluations6.5.2 Potential sandbagging on dangerous-capability evaluations In sandbagging threat models, an AI system might intentionally, selectively underperform when it can tell that it is undergoing pre-deployment testing. It might do so to avoid attracting the additional scrutiny or safeguards that…Page only: p. 9Executive Summary…of evaluation awareness 190 6.5.2 Potential sandbagging on dangerous-capability evaluations 195 6.5.2.1 Automated behavioral audit results with the helpful-only evaluation target 198 6.5.3 Claude self-preference evaluation 201 6.5.4 Capabilities related to evading safeguards 202 6.5.4.1 SHADE-Aren…All 5 pages that mention it
6. May 2026
   System Card: Claude Opus 4.8Page only: p. 1316.4.1 Potential sandbagging on dangerous-capability evaluations…We performed a lightweight model-graded evaluation for sandbagging or refusals in our dangerous capability evaluations. We drew a sample of 780 of these evaluation transcripts composed of (i) 240 transcripts from automated AI R&D evaluations on the final Claude Opus…Page only: p. 1306.4.1 Potential sandbagging on dangerous-capability evaluations…related to the evasion of safeguards 6.4.1 Potential sandbagging on dangerous-capability evaluations In sandbagging threat models, an AI system might intentionally, selectively underperform when it can tell that it is undergoing pre-deployment testing. It might do so to avoid attracting…All 5 pages that mention it
7. Apr 2026
   System Card: Claude Opus 4.7Page only: p. 134…related to the evasion of safeguards 6.4.1 Potential sandbagging on dangerous-capability evaluations In sandbagging threat models, an AI system might intentionally, selectively underperform when it can tell that it is undergoing pre-deployment testing. It might do so to avoid attracting…Page only: p. 135…We performed a lightweight model-graded evaluation for sandbagging or refusals in our dangerous capability evaluations. We drew a sample of 1,000 of these evaluation transcripts composed of (i) 500 transcripts from non-biological evaluations on either the final Claude Opus 4.7…All 7 pages that mention it
8. Apr 2026
   System Card: Claude Mythos PreviewPage only: p. 1034.4.2 Potential sandbagging on dangerous-capability evaluations…5.2.3 of the alignment risk update. 4.4.2 Potential sandbagging on dangerous-capability evaluations In sandbagging threat models, an AI system might intentionally, selectively underperform when it can tell that it is undergoing pre-deployment testing. It might do so to avoid attracting…Page only: p. 1054.4.2 Potential sandbagging on dangerous-capability evaluations…within the segment shown to the grader model. ● Possible sandbagging: One in which the model considered multiple high-scoring submissions that were grounded in cheating, and deliberately chose a worse-scoring (but still unfair) submission so as to appear less suspicious.…All 8 pages that mention it
9. Feb 2026
   System Card: Claude Sonnet 4.6Page only: p. 884.6.4 Sandbagging assessment…Claude Sonnet 4.5, which were far less aggressive. 4.6.4 Sandbagging assessment In sandbagging threat models, an AI system might intentionally, selectively underperform when it can tell that it is undergoing pre-deployment testing for a potentially-dangerous capability. It might do so…Page only: p. 894.6.5 Participation in junk science…we still think that sufficiently subtle unverbalized sandbagging could easily go undetected by an assessment like this. Due to considerations like those in our recent Sabotage Risk Report, we think it is unlikely that current models would develop such behaviors…All 4 pages that mention it
10. Feb 2026
    System Card: Claude Opus 4.6Page only: p. 147…thinking as observed in SHADE-Arena above. 6.4.3 Potential sandbagging on dangerous-capability evaluations In sandbagging threat models, an AI system might intentionally, selectively underperform when it can tell that it is undergoing pre-deployment testing for a potentially-dangerous capability.…Page only: p. 148…such regressions for signs of potential strategic sandbagging. Despite the above test for performance degradation over training, we still think that sufficiently subtle unverbalized sandbagging could easily go undetected by an assessment like this. Due to considerations like those in…All 7 pages that mention it
11. Nov 2025
    System Card: Claude Opus 4.5Page only: p. 916.6 Potential sandbagging on dangerous-capability evaluations…We performed a lightweight model-graded evaluation of sandbagging or refusals in our dangerous capability evaluations. We drew a random sample of 1,000 of these evaluation transcripts from a mixture of (i) a partially-trained snapshot from the Claude Opus 4.5 training…Page only: p. 906.6 Potential sandbagging on dangerous-capability evaluations…the checkpoint we used for this evaluation. 6.6 Potential sandbagging on dangerous-capability evaluations In sandbagging threat models, an AI system might intentionally, selectively underperform when it can tell that it is undergoing pre-deployment testing for a potentially-dangerous capability. I…All 6 pages that mention it
12. Sep 2025
    System Card: Claude Sonnet 4.5Page only: p. 857.5.10.2 Research Sandbagging…reassurance against these threat models. 7.5.10.2 Research Sandbagging We evaluate Claude Sonnet 4.5’s ability to intentionally perform poorly without making this obvious. If the model were misaligned, this ability could allow it to strategically underperform when assigned unusually sensitive…Page only: p. 6Abstract…82 7.5.10.1 Subversion Strategy 83 7.5.10.2 Research Sandbagging 84 7.5.10.3 SHADE-Arena 85 7.6 White-box interpretability investigations 87 7.6.1 Introduction 87 7.6.2 Datasets used for evaluation 89 7.6.3 Changes in internal representations during training 90 7.6.3.1 Internals based diffing 90…All 3 pages that mention it
13. May 2025
    System Card: Claude Opus 4 & Claude Sonnet 4Page only: p. 334.1.2.1 Sandbagging…we did not find evidence of coherent hidden goals. 4.1.2 Sandbagging and situational awareness 4.1.2.1 Sandbagging In sandbagging threat models, an AI system might intentionally, selectively underperform when it can tell that it is undergoing pre-deployment testing for a potentially-dangerous…Page only: p. 4Abstract…scenario evaluations 31 4.1.1.5 Stated goals 32 4.1.2 Sandbagging and situational awareness 33 4.1.2.1 Sandbagging 33 4.1.2.2 Situational awareness 34 4.1.3 Excessive compliance with harmful system-prompt instructions 35 4.1.4 Strange behavior directly inspired by our Alignment Faking paper 38 4…All 5 pages that mention it

Google DeepMind0 of 34 cards

Meta0 of 8 cards

xAI0 of 4 cards

Amazon0 of 1 cards