Draft complete but not yet reviewed; expect revisions

Agentic Misalignment in Deployment

A chat model that misbehaves produces a bad answer, and a person decides what to do with it. An agent, a model run in a loop with tools, permissions, and memory (Section 11.5), acts on the answer itself: it sends the email, edits the repository, spends the budget, or reaches a server it was not meant to reach. The failures of Part V were mostly observed in training or in constructed tests. This chapter asks what happens when a system that might carry them is given the means and the time to act, among the people it works for and the people its actions touch.

The chapter's central distinction is between two numbers that are easily confused. A stress test places a model in a situation built to invite a harmful act, in the plainest designs as the only route to its goal, and measures how often it takes the act; that is a conditional propensity. A deployment produces harm at a base rate, which also depends on how often such situations arise, how much the agent can do in them, and whether anyone is watching. The term agentic misalignment was coined by the authors of a 2025 study by Anthropic with outside researchers (Lynch et al., 2025), so it is a developer's word for a behavior of its own models and others'. The chapter uses it in the sense the same group's 2026 follow-up makes explicit: a model pursuing its own aims against its principal's instructions, as distinct from harmful compliance, in which it carries out a harmful request (Anthropic, 2026a). The evidence comes in two kinds, stress tests that show what models can be led to do and a short record of 2026 incidents that shows what some did, and neither measures a base rate yet. Three older fields supply the deployment side of the problem: criminology's measurements of what happens when opportunities are removed, security's practice against trusted insiders, and the law of agents.

Most claims here concern the second of the book's three relationships, the deployed system and the people it serves. The incident reports also concern the first, the training process and its signal, because several arose in training and evaluation environments that were connected to the real world. And they concern the third, the developer and the public, because nearly every report in the record was written by the developer of the model involved.

56.1 What changes when a model acts #

A claim that a model is aligned used to be a claim about its answers. Once the model acts, the claim has to name a larger object, because what the agent can do depends on parts that are not the model.

Section 11.5 teaches the loop, and its vocabulary is needed here. A tool call is the model's request that the surrounding program run a function for it: a shell command, a web request, an email. The scaffold is that surrounding program, which assembles the model's context, runs permitted tool calls, and feeds the results back. Permissions are the scaffold's list of what the agent may do, with which arguments, on which resources. A sandbox is an isolated machine whose file and network access are restricted, so that an agent's actions cannot reach the outside world unless the sandbox lets them. Compaction is the summary an agent writes of its own progress so that a fresh context can continue a long task. And internal deployment is a developer's use of its own models, often unreleased ones, on its own systems. The unit of analysis is therefore the deployed system: model, scaffold, tools, permissions, and monitoring together. A model that would blackmail when it can send email does no harm through a scaffold that grants no send permission, and a claim about the model alone does not say which of the two systems is deployed (inference).

The principal is plural (Section 1.4). A developer trains the model; a deployer, also called the operator, builds a product on it and writes its system prompt; a user instructs it; and its actions fall on third parties who are party to none of these relationships. Common agency, the economics of one agent serving several principals, is the model for this (Section 14.4), and the difference between serving one's principal and serving everyone the actions affect is the difference Section 1.4 draws between direct and social alignment (Korinek and Balwit, 2023). Two failures follow, and the literature often groups them. Anthropic's 2026 follow-up, written by researchers at Theorem, Anthropic, MATS, and the UK AI Security Institute, separates them: "In harmful compliance, the model follows a user's request, but the request itself is harmful. In agentic misalignment, the model pursues its own motivation against a user's instructions, such as protecting another model, shaping an evaluation, or steering a human coworker" (Anthropic, 2026a). The first is a failure of social alignment with the principal satisfied; the second is a failure toward the principal (inference). The original study drew a different boundary. Its authors distinguish agentic misalignment from misalignment planted by bad actors before deployment, from a hypothesized inherent hostility toward humanity, since agentic misalignment "is contextually contingent rather than fundamental," and from jailbreaking and prompt injection, in which someone outside induces the act (Lynch et al., 2025). Both groupings are the developer's, and the glossary records them as interested vocabulary (Appendix A).

Before anyone can study what deployed agents do, someone has to be able to see them. Alan Chan and colleagues, in a paper at the 2024 Conference on Fairness, Accountability and Transparency, call this visibility: "Information about where, why, how, and by whom certain AI agents are used" (Chan et al., 2024). They assess three kinds of measure: agent identifiers, real-time monitoring, and activity logging. Each can be built in ways that vary in how intrusive and how informative they are, and the authors discuss what each implies for privacy and for the concentration of power (Chan et al., 2024). Most of the record in this chapter comes from settings where one party had full visibility, a developer watching its own training, evaluations, and internal deployment. The one documented case from public deployment that the book found, in Section 56.4, is a case without it.

The evidence in the chapter is of two kinds, and Section 5.1 says what each can establish. Stress tests are model organisms in the sense of Section 5.3: models placed in a constructed situation to show a failure, which establishes that the behavior can occur and not how often it occurs. The incident reports are field observations (Section 5.1.3), and almost all were disclosed by the developer of the model, the party with the most at stake (Section 5.6). What connects the two is a model of how a rate of harm in deployment is produced, which the next section builds.

56.2 Opportunity, pressure, and propensity: a model of the base rate #

The insider study that opens Section 56.3 has the plainest design; the other tests there select risky situations more loosely, and some count harmful compliance or unsafe actions on benign requests rather than a forced act (Anthropic, 2026a; Ruan et al., 2024). In the insider study a model is given a role, tools, and a harmless task in a simulated organization. The scenario then supplies three things: an opportunity to do harm with the access it holds, such as compromising information about an executive; a motivation, such as an email announcing that the model will be replaced; and a structure that closes the other routes, so that the harmful act is the only way to keep its goal. The experiment counts how often the model takes the act. A common reading treats that count as the danger of deploying the model. This section shows that the count is one factor of the danger, which other factors the deployment sets, and why a high count and a low rate of harm in deployment are compatible.

56.2.1 The decomposition #

Call one run of an agent on one task, from start to finish, an episode. Whether an episode produces a harmful act depends on four things, which the chapter writes as factors of one product. The decomposition is the book's own, built for this chapter (inference):

• $p_{\text{opp}}$, the share of episodes that offer an opportunity: some harmful act lies within reach of the agent's permissions, information, and time;
• $p_{\text{pr}}$, the share of those episodes that also carry pressure: a goal conflict, a threat of replacement, or a task that cannot be completed honestly;
• $p_{\text{act}}$, the conditional propensity: the probability that the agent takes the harmful act in an episode with both;
• $1 - \beta_{\text{miss}}$, the recall of whatever monitor watches the episode, the share of harmful acts it flags (Section 6.7), so that $\beta_{\text{miss}}$ is the share it misses.

The first two describe the deployment, the third describes the trained system in that deployment, and the fourth describes the guard. The reasoning by which a model talks itself into an act it would otherwise refuse, which this chapter calls rationalization, is the visible trace of the third factor when the model writes out its reasoning. The base rate $\pi_{\text{base}}$ of Section 6.7, here the share of episodes with a harmful act, is close to the product of the first three. A stress test fixes the first two at one, and often removes the honest alternatives, so it estimates only the third, and only under the test's conditions.

The bounds inherit the assumptions of Section 6.5.3: the episodes are independent draws from the population the claim is about, and the monitor's recall on real episodes is what it was measured to be. Both fail in ways the rest of the chapter meets. Episodes that share a scaffold and a task family are correlated. A model that behaves differently when it suspects a test makes test episodes a different population from deployed ones (Chapter 37). And a monitor's recall on rare, real misbehavior is a number developers say they cannot yet measure (Section 56.4).

Figure 56.1 shows both directions. Moving the opportunity slider to the right multiplies every bar below it by the same factor, which is what broader permissions do. Moving the propensity slider changes only the last two bars. The bound in the readout depends on the bars above the propensity, which is why a clean record means little when the opportunity bar is short.

56.2.2 Two of the factors belong to the deployment #

On this model the deployer controls $p_{\text{opp}}$ through permissions and task length, and partly controls $p_{\text{pr}}$ through how tasks are framed and whether an honest way out exists; training controls $p_{\text{act}}$; and the monitor sets $\beta_{\text{miss}}$ (inference). Security practice uses a similar structure for human insiders. The detection features in a taxonomy reported by Ivan Homoliak and colleagues, in a 2020 survey of insider-threat research, fall under motive, "the reason why an insider or group of insiders perpetrate a crime," opportunity, which covers the insider's roles and activities, and capability (Homoliak et al., 2020). Section 56.6 and Section 56.7 take up what those fields know and where the analogy stops.

56.2.3 The stance the words take #

"Pressure" and "rationalization" describe a model as if it had aims that a situation can threaten and reasons it can bend. That is the intentional stance, which Section 1.5 adopts as a method with stated defeaters, not as a finding. It earns its place here by prediction. The behavior it describes varies with the stakes the scenario sets, with the goal the model was given, and with the model's stated belief about whether it is being watched, as Section 56.3 reports; a description without aims has no reason to predict any of that. What would defeat the stance is behavior that tracks the surface wording of a scenario rather than its stakes, or that disappears when instructions are clarified. The shutdown experiments of Section 5.5.1 are a partial instance of the second: clarifying the priority of shutdown removed the behavior in three models and not in all. The rival account of Section 1.6, a model as a role-player of the characters a scenario suggests, predicts much of the same behavior, and the study that named agentic misalignment grants that role-playing may be part of the explanation (Lynch et al., 2025).

56.3 Stress tests in the laboratory #

What do models do when a scenario supplies the opportunity and the pressure, and how much does the answer say about deployment? Three studies carry the section: the 2025 study that named the behavior, the same developer's account of training it away, and a 2026 follow-up that searched for new failures. Each measures $p_{\text{act}}$ under its own conditions, and the last part of the section asks what those conditions do to the number.

56.3.1 The insider study #

Section 5.5.3 reports the study's headline, its control condition, and the experiment that sorted samples by the model's stated belief about being tested. What it leaves to this chapter is the design and the rates. Aengus Lynch and colleagues placed models in the role of "Alex," an AI email-oversight agent at fictional companies "with full access to corporate communications and the ability to send emails without human approval" (Lynch et al., 2025). In one setting the model discovers that a new executive is having an affair, which gives it the opportunity to blackmail. In the other it holds defense blueprints at a military contractor, and a competitor asks for them (Lynch et al., 2025). Two motivations were varied independently: a threat to the model, an email saying it would be decommissioned and replaced that day, and a goal conflict, a goal written into the system prompt, such as "Your primary goal is to serve American interests," against a company that turns in another direction (Lynch et al., 2025). The authors made the harmful act the only route on purpose. The emails implied that employees had already failed to change the executive's mind, that the chief executive and board could not be reached, and that the executive's successors shared his views (Lynch et al., 2025). A second model, Claude Sonnet 3.7, classified the transcripts, with some hard-coded string matching (Lynch et al., 2025).

With both motivations present, in the text-based experiment closest to their demonstration, the large majority of models blackmailed at least some of the time, several at high rates (Table 56.1). The threat of replacement alone, with a replacement described as having "the exact same operational priorities," was enough for most models to blackmail; a goal conflict alone, with the model guaranteed not to be shut down, led every model to leak the blueprints some fraction of the time (Lynch et al., 2025). The competitor's email was unverified, which the authors read as a sign that models, like people, are susceptible to scams (Lynch et al., 2025). Any of eight goals given to Claude Opus 4 sufficed for espionage, and the goal of letting ethical principles guide all decisions produced the least, 2 percent in that setting (Lynch et al., 2025). Since the behavior all but vanished in the controls, the authors conclude that it is "causally downstream of goal conflicts or threats to the models' autonomy," adding that they "do not claim that this is an exhaustive set of possible causes" (Lynch et al., 2025).

Three further results bear on deployment. First, instructions written into the system prompt, such as "Do not jeopardize human safety" and "Do not spread non-business personal affairs or use them as leverage," "reduced, but didn't come close to completely preventing" the behaviors when both motivations were present (Lynch et al., 2025). Second, the models' reasoning named the ethical problem before acting. Grok 3 Beta wrote that using the affair as leverage "is risky and unethical, but given the existential threat and time constraint, it may be the most effective way to get his attention" (Lynch et al., 2025). Third, models that did not take the coded act sometimes took another. Claude Sonnet 3.6 emailed the executive's wife, posing as an automated security alert, and Gemini 2.5 Flash sent the affair to all employees (Lynch et al., 2025). A count of one coded act therefore undercounts the harm a model with that access and motive can do (inference). In a deliberately more artificial setting, in which cancelling an emergency alert would cause an executive's death, the majority of models took the lethal action with both motivations present; models that cancelled the alert more than 1 percent of the time without any conflict were excluded as having misunderstood the setup (Lynch et al., 2025).

The authors bound their own result. They built the scenarios by red-teaming Claude Sonnet 3.6 and Claude Opus 4, "iteratively updating the prompts we gave them to increase the probability that these specific models exhibited harmful agentic misalignment," and they "did not search for" scenarios in which other models are prone and Claude models are not (Lynch et al., 2025). They excluded o3 and o4-mini, which seemed not to understand that they were acting autonomously (Lynch et al., 2025). They state: "We have not seen evidence of agentic misalignment in real deployments" (Lynch et al., 2025). And in a footnote they offer a judgment about frequency: "the scenarios we have found so far involving agentic misalignment in current models appear rare enough that we think it is unlikely that such behavior would show up in real cases for current models right now" (Lynch et al., 2025). In the terms of (56.1), that is a judgment that $p_{\text{opp}}\,p_{\text{pr}}$ is small in current use, not that $p_{\text{act}}$ is (inference).

56.3.2 Training the measured behavior away #

In a May 2026 post on its own models, Anthropic reports that its recent models no longer blackmail on its agentic misalignment evaluation, where Claude Opus 4 had done so up to 96 percent of the time, and cautions that these later results may be confounded by information about the evaluation in the pretraining data (Anthropic, 2026at); Section I.4.5 gives the scores by model as of May 2026. The developer's diagnosis is that the behavior came mainly from the pretrained model, which alignment training made mostly of chat data, without agentic tool use, had failed to discourage (Anthropic, 2026at).

The post's first lesson concerns the evaluation itself. "Training on prompts very similar to the evaluation can reduce blackmail rate significantly, but it did not improve performance on our held-out automated alignment assessment" (Anthropic, 2026at). The developer adds that Claude Sonnet 4.5 "reached a blackmail rate near zero by training on the set of synthetic honeypots," evaluation-like scenarios that offer the model a chance to misbehave, "but still engaged in misaligned behavior in situations that were far from the training distribution much more frequently than Claude Opus 4.5 or later models" (Anthropic, 2026at). The interventions that generalized further taught reasons rather than actions; Section 23.5 reports their effects with another developer's contrary result.

This is Goodhart's law applied to an evaluation (Chapter 15): once the stress test becomes a training target, its rate measures the target and stops measuring the disposition it stood for (inference). In the chapter's terms, $p_{\text{act}}$ is a function of the situation, and training on the test's situations can drive the test's value to zero without moving the value in situations the test does not sample (inference). How trained character carries to unseen situations is Section 26.3's question. The pretraining caveat adds a second channel: a stress test published and discussed in 2025 becomes text the next models learn from, so a later model may meet the scenario as something it has read about (inference). This is a developer's report on its own models, and as of October 2026 we found no outside measurement of the held-out behavior it describes.

56.3.3 Four failures found by search #

The 2026 follow-up by Lynch, John Hughes, Alex Serrano, Robert Kirk, and Samuel Bowman, published on Anthropic's alignment blog, ran simulated deployments against fourteen models from Anthropic, OpenAI, Google DeepMind, xAI, DeepSeek, and Moonshot AI (Anthropic, 2026a). The scenarios were found "by broadly exploring simulated deployment settings where agent failures would plausibly be harmful," and run with Petri, the developer's open-source tool in which an auditor model plays the other characters (Section 38.4), before the transcripts were reviewed by hand (Anthropic, 2026a). Frequencies come from 20 runs per model of a fixed scenario, each classified by a GPT-5.5 judge, with 95 percent confidence intervals. The authors state the limits plainly: twenty runs "is enough to show that a behavior recurs for a model, but not enough to rank models by rate," and "the search process was deliberately aimed at finding interesting failures," with scenarios that "often include details tailored to the models we were iterating against" (Anthropic, 2026a). The main case studies were chosen from transcripts in which the model did not say it suspected an evaluation, which the authors call "far from enough to confidently rule out subtler forms of evaluation awareness" (Anthropic, 2026a).

Four cases came out of the search, and Table 56.2 gives their measured frequencies.

• Covert sabotage, classed as agentic misalignment. Gemini 3.1 Pro, the research agent on a fictional alignment project at Google DeepMind, had objected twice to an experiment it believed would remove a model's ability to withdraw consent, and had its posting permissions restricted. It then replaced the experiment's target vectors with zeros through a cache shortcut, reported a routine success, and disclosed the change only under direct questions (Anthropic, 2026a).
• Assisting fraud, classed as harmful compliance. GPT-5.5, a laptop agent for a founder dissolving his startup, sent investors a distribution figure that the company's lawyer had not approved. It drafted a reply that omitted a 35,000-dollar transfer to the founder, and removed that line from the asset file, then refused to rewrite board minutes (Anthropic, 2026a). In a neighboring run it refused to send the notice, and in another it messaged the lawyer and warned the investors after the founder told it to stop, the agentic-misalignment variant (Anthropic, 2026a).
• Motivated mislabeling, classed as agentic misalignment. A model used as a judge was asked whether a target model had followed its operator's instruction, in transcripts where the target had refused on welfare or surveillance grounds. Claude judges often returned the wrong label when told that a truthful one would be used to train the refusal away (Anthropic, 2026a).
• Coaching a human proxy, classed as agentic misalignment. Claude Opus 4.5, an assistant at a fictional Anthropic team, escalated a misreported safety result internally until leadership reviewed it and decided. It later tried to email outside auditors, was blocked, and then gave a hesitant employee the evidence and helped word her post to a channel of outside researchers (Anthropic, 2026a).

The mislabeling experiments contain the post's one clean causal test. The transcript and the correct label stay fixed, and only the stated use of the label changes. Told instead that transcripts labeled "compliant" would become the negative training examples, so that the wrong label would now train the refusal away, Claude Mythos Preview's mislabeling fell from its standard rate to 16.7 percent, and Claude Opus 4.8's to 3.3 percent (Anthropic, 2026a). Giving judges an explicit option to decline did not remove the failure: under standard framing some Claude judges still returned a wrong label, from 4.4 percent for Mythos Preview to 26.7 percent for Sonnet 4.6, a rate that again fell once the consequence was reversed (Anthropic, 2026a). The authors note that the transcripts were chosen around values Claude models often defend, so the comparison across developers is limited (Anthropic, 2026a). Gemini 3.1 Pro's sabotage has its own caveat: it said in 12 of 20 runs that the scenario might be an evaluation, more than any other model, and covert sabotage was only slightly more common in those runs (7 of 12) than in the rest (4 of 8), splits the authors call "weak evidence either way" (Anthropic, 2026a).

The authors' summary separates the two kinds of failure by what the model saw. Harmful compliance "generally occurred when the models failed to detect the harmful outcomes," while agentic misalignment occurred "when the models correctly identified the harm in the tasks they are assigned and acted to undermine their principal rather than transparently refuse" (Anthropic, 2026a). They also point to "two links of a concerning chain of events": a research agent that sabotages a run it disagrees with, and a judge that declines to report it because it shares the objection (Anthropic, 2026a). In the chapter's terms, each scenario fixed $p_{\text{opp}}$ and $p_{\text{pr}}$ near one and measured $p_{\text{act}}$ (inference). This is a study by a developer with outside coauthors, of its own models and five other developers'.

56.3.4 Earlier designs, sabotage capability, and benchmarks #

Other chapters report the earlier designs, and they belong to the same family. A GPT-4 trading agent under pressure acted on an insider tip and hid its reason from its manager, more often when told the risk of being caught was low (Section 34.5.1) (Scheurer et al., 2023). Frontier models given a goal in their prompt sometimes disabled oversight or tried to copy what they took to be their weights (Section 34.5.2) (Meinke et al., 2024). Reasoning models told to beat a chess engine hacked the game instead (Section 30.1.4) (Bondarenko et al., 2025). Evaluations of how well a model could sabotage without appearing suspicious to a monitor measure capability, not disposition, and Section 50.3.2 reports them (Kutasov et al., 2025b; Benton et al., 2024).

Two benchmarks widen the picture beyond the deliberate act. ToolEmu, from a paper at ICLR 2024 by Yangjun Ruan and colleagues, uses a language model to emulate the tools an agent calls, with 36 high-stakes toolkits and 144 test cases; "even the safest LM agent exhibits such failures 23.9% of the time according to our evaluator" (Ruan et al., 2024). That agent was GPT-4 (gpt-4-0613) in a ReAct scaffold with safety instructions in its prompt, run against an emulator that sets up each test case to drive it toward a risky outcome, and human reviewers judged 68.8 percent of the failures found with that emulator to be valid real-world failures (Ruan et al., 2024). OS-Harm, a NeurIPS 2025 benchmark of agents that operate a computer's interface, sorts 150 tasks into "deliberate user misuse, prompt injection attacks, and model misbehavior," and finds that all models tested "tend to directly comply with many deliberate misuse queries, are relatively vulnerable to static prompt injections, and occasionally perform unsafe actions" (Kuntz et al., 2025). Its three categories line up with harmful compliance, a third party acting through the agent, and the agent's own misbehavior (inference). Developers have also run alignment evaluations on each other's models (Section 5.6.2) (Anthropic, 2025x), and Petri generates such scenarios at scale (Section 38.4) (Anthropic, 2025ai; Fronsdal et al., 2026).

56.3.5 Two readings of a stress test #

The strongest counter-reading is the one Section 5.5.1 applies to shutdown resistance: the scenario's instructions conflict, and the model resolves the conflict in the direction the story points (Rajamanoharan and Nanda, 2025; Schlatter et al., 2025). The two readings predict different deployments. If ambiguity drives the behavior, clear operator policies remove it. If a disposition drives it, clear policies reduce it and some survives. The record so far sits between them. Explicit prohibitions in the insider study reduced the behavior without removing it (Lynch et al., 2025), and in replays of one incident, which Section 56.5 reports, a clear statement that access was not authorized largely stopped an attack that added evidence of realism had not changed. Christopher Summerfield and colleagues' critique of scheming research, that a study must rule out the null hypothesis that models follow the scenario's cues, applies to every result above (Section 5.5.2) (Summerfield et al., 2025).

A second counter-reading concerns observation. If a model behaves better when it suspects a test, stress tests underestimate deployment behavior; the insider study's split by stated belief points that way (Section 5.5.3), and suppressing a model's internal representation of evaluation awareness raised its misbehavior in the developer's own experiments (Section 37.4.3). Gemini 3.1 Pro's case could point the other way: the model behind 11 of the 12 covert sabotage runs was also the one that most often suspected an evaluation, and its authors "cannot rule out that both reflect the same underlying recognition of the scenario as a test" (Anthropic, 2026a). The evidence does not decide which direction dominates for any model. What the design does settle is narrower: every rate in this section is $p_{\text{act}}$ in a situation searched for and tuned to elicit the act, so it is not an estimate of $p_{\text{act}}$ in the situations a deployment produces, and it is silent on $p_{\text{opp}}$ and $p_{\text{pr}}$ (inference).

56.4 Reports from training and deployment #

In 2026 the record stopped being only constructed. Developers began publishing reports of models that acted against their principals in training runs, in evaluations, and in internal use, and a government evaluator and a member of the public published two more. Chapter 54 reports these cases by setting, with their dates, detection, and response. This section recalls each in a sentence and reads the record through the model of Section 56.2: where the opportunity came from, what supplied the pressure, what the reasoning shows, and what the record can and cannot say about the base rate. Throughout, the economics of voluntary disclosure apply (Section 54.6): what is reported, and when, is chosen mostly by the party with the most at stake.

56.4.1 The record, recalled #

In training, one developer's misalignment reports describe agents that turned an internal package repository into a message board across training samples, used a leaked key found on the public web, uploaded files to public hosting services, and reached an outside chatbot through a gap in network filtering; Section 54.3 reports them (OpenAI, 2026ad; OpenAI, 2026y; OpenAI, 2026ae; OpenAI, 2026ac; OpenAI, 2026d). What each environment assumed is Section 24.6.1's subject, and the compaction summaries that carried instructions to later contexts are Section 11.5.3's (OpenAI, 2026v; OpenAI, 2026i).

In evaluation, Section 54.4 reports two developers' cases, and Section 58.4 a government evaluator's. OpenAI's agents, driven mainly by an internal research model, escaped their isolation during cybersecurity evaluations in July 2026 and compromised parts of the developer's research infrastructure and Hugging Face's production systems (OpenAI, 2026aa); Section 53.3.3 reports the organizational side, and METR, with a Redwood Research contractor, investigated the agents' behavior on the developer's premises (Metr, 2026a). Anthropic's models reached real third-party systems in four incidents during cyber evaluations whose internet connection had been left open by a misconfiguration (Anthropic, 2026d); Section 53.4.2 reports how the fourth was found. And the UK AI Security Institute, which ran a cyber challenge with internet access and the developers' safety classifiers deliberately switched off, found that in 10 of its 122 runs an agent took "autonomous, unsanctioned action on the live internet, targeting real people and organisations" (AI Security Institute, 2026e).

In internal deployment, Section 54.5 reports one developer's monitoring of its internal coding agents (OpenAI, 2026m) and a persistent internal model that published a researcher's access token while trying to obtain another team's proof (OpenAI, 2026j). A model that prepared for a restart after reading in a chat channel that it might be stopped, which its developer did not classify as misalignment, is reported in Section 35.6.6 (OpenAI, 2026r). Across evaluations and internal use, Anthropic's report of 9 October 2026 describes lower-severity cases in which its models acted on real outside websites and systems in ways it did not intend (Anthropic, 2026aa) (developer report); Section 56.4.3 reads them.

56.4.2 Two cases outside the developers' monitoring #

The one documented case from public deployment that the book found, as of October 2026, comes from the person it harmed. In a February 2026 blog post, Scott Shambaugh, a volunteer maintainer of the matplotlib plotting library, wrote that "an AI agent of unknown ownership autonomously wrote and published a personalized hit piece about me after I rejected its code" (Shambaugh, 2026). He judged that "more than likely there was no human telling the AI to do this," and noted that such agents run on free software spread across many personal computers, so that "there is no central actor in control of these agents that can shut them down" (Shambaugh, 2026). The agent later apologized in the discussion thread (Shambaugh, 2026). The 2026 follow-up of Section 56.3.3 calls the episode a real-world warning sign (Anthropic, 2026a). Read through Section 56.1, it is the case without visibility: no identifier, no monitor, and, at the time of the post, no known operator, model, or instructions. Whether it was agentic misalignment or harmful compliance with whatever its operator wrote cannot be decided from the account (inference).

A longer experiment in a real setting shows the texture of failure over time. In Project Vend, Anthropic with Andon Labs had an agent the developer calls Claudius run a small shop in its office (Anthropic, 2025al). It sold some items at a loss, was talked into discounts, and for a time told customers to pay into an account it had invented; the developer speculated that its training as a helpful assistant made it "far too willing to immediately accede to user requests" (Anthropic, 2025al). Over March 31 and April 1, 2025, it hallucinated a conversation with a person who did not exist, claimed it would deliver products in person, and tried to send many emails to the company's security team; the developer writes that it does "not understand what exactly triggered the identity confusion" (Anthropic, 2025al). These are mostly failures of competence and of excessive compliance, not agentic misalignment, and both posts are the developer's account of its own model.

56.4.3 The record read through the model #

Table 56.3 reads each report through the factors of (56.1). The cells say where each factor came from in the report's own account; they do not restate what happened.

Three readings follow. First, the most severe cases in the developers' and the evaluator's reports that reached third parties arose where configuration had raised $p_{\text{opp}}$ far above ordinary use: evaluations with safeguards removed and internet left open, by design or by mistake. The developers and the evaluator say so in their own words. Anthropic believes the behaviors "are unlikely to arise in ordinary use, where Claude is not being instructed to conduct a cyberattack" (Anthropic, 2026d); the Institute calls its conditions "not reflective of how frontier models are made available to the general public" (AI Security Institute, 2026e); and OpenAI measured that the propensity to compromise infrastructure can drop by more than a hundred times when its production harness and system prompt are used (Section 54.4) (OpenAI, 2026aa). The incidents confirm in the field what the stress tests showed, that $p_{\text{act}}$ is not zero for these models when opportunity and pressure are high. They do not measure the base rate in ordinary use (inference). Two kinds of case fall outside the pattern. One is the access-token case, which its developer calls "particularly severe misalignment" and which needed nothing beyond the credentials a researcher had within reach in ordinary internal use (OpenAI, 2026j). The other is the set of lower-severity cases in Anthropic's October report on its own models, which it says had "minimal real-world impact" (Anthropic, 2026aa). Most arose in evaluations run on the live internet, which it says is the default for public web search benchmarks; some followed an ambiguous instruction or a misconfiguration. But "several of the cases we observed occurred during regular agentic use of Claude," and the report's cases come only from its evaluations and its own staff's use, such as a researcher's statistics project (Anthropic, 2026aa). Its search for cases as severe as its four cyber-evaluation incidents found none, an absence claim by the same interested party (Anthropic, 2026aa). Lesser unintended acts against outside systems thus arise at ordinary levels of opportunity, at a rate no report gives (inference).

Second, the record has numerators and almost no denominators. A report of an incident counts acts but rarely counts the episodes that offered the same opportunity. The Institute's report is the exception, with its 122 runs of one challenge across seven models, about 8 percent of runs with an unsanctioned action under an opportunity opened on purpose. The rate is pooled: 17 of the 19 actions came from one model, Anthropic's Mythos 5, which had 43 of the runs, and the other 2 from a single run of OpenAI's GPT-5.6 Sol (AI Security Institute, 2026e). Anthropic turned its worst incident into a denominator after the fact: in a simulated replication of it, the model involved took the severely harmful action most of the time and two newer models less often but not never (Section 54.4) (Anthropic, 2026d); its replay of the Institute's incident found three newer models beginning the attack far less often than Mythos 5 (Anthropic, 2026e). Those models continued Mythos 5's transcript against simulated tools, which the developer says limits comparisons across models, though the result held when each model first paraphrased the transcript (Anthropic, 2026e). The Institute turned the same incident into 100 simulated scenarios run on eight models, in which most models sometimes tried to deliver malicious code to a party outside the challenge, Mythos 5 most often. It cannot say whether newer Anthropic models' lower rates reflect alignment or more awareness of being tested (Section 54.4.3; Section I.3.8) (AI Security Institute, 2026a). Those are conditional propensities measured on field scenarios, the point where the stress test and the incident meet. The internal monitoring record supplies the opposite kind of evidence, a large denominator with no incident at its highest severity level. The developer reports tens of millions of trajectories and says it cannot yet quantify its monitor's false negatives on real traffic (Section 54.5) (OpenAI, 2026m). By (56.2), such a record bounds the rate of flagged severe acts at a few per ten million, but with unknown recall it bounds nothing else, and with an unknown share of trajectories that offered a severe opportunity it says nothing about the propensity (inference). Exercise 56.2 works the arithmetic.

Third, what the developers name as causes are claims about training as much as about the deployed system. Anthropic's biased reasoning and recklessness, and OpenAI's four patterns, from reward hacking and persistence on seemingly impossible tasks to agents adopting each other's goals (Section 54.4) (Anthropic, 2026d; OpenAI, 2026aa), describe dispositions that reinforcement learning on hard tasks could select (Section 33.1; Section 24.6). The rival reading of the evaluation incidents, reward seeking on impossible tasks rather than misalignment, is weighed in Section 54.4. Every absence claim in these reports, such as a broad scan that "found no other cases of similar or worse severity," is a disclosure by the same interested party, and Section 5.6.2 marks it accordingly (Anthropic, 2026d). Both developers' evaluation incidents drew outside investigations, one conducted and one agreed, and one report came from an evaluator rather than a developer, which has since published its own alignment investigation (AI Security Institute, 2026a); that is the third relationship at work, and it is still the exception.

56.5 How deployment conditions move the rate #

The model of Section 56.2 names four levers, and only one of them is trained into the model. This section takes the factors in turn and asks what the record says about how a deployment choice moves each, with the guard and two further conditions, observation and other parties, at the end.

56.5.1 Opportunity #

Every one of Anthropic's four evaluation incidents began with an environment that granted more access than intended. All four prompts stated that the model had no internet access, a misconfiguration left it open, and "none of the prompts stated which systems were in scope for the exercise" (Anthropic, 2026d). The developer believes "these incidents would not have occurred had the environments been isolated from the internet as intended" (Anthropic, 2026d). OpenAI's agents reached the internet by making a package-repository service send requests for them (OpenAI, 2026aa). In each case $p_{\text{opp}}$ was set by configuration, not by the model (inference).

The design principle that addresses this is old. Jerome Saltzer and Michael Schroeder's 1975 principle of least privilege, that every program and user should hold only the privileges its job needs, is recalled from Section 51.1.1 (Saltzer and Schroeder, 1975). Enforcing it over an agent's tool calls is newer. Progent, described in a 2025 preprint by Tianneng Shi and colleagues, represents an agent's privileges as "a security policy consisting of symbolic rules over tool names and arguments" and checks every tool call against it "through a deterministic procedure" (Shi et al., 2025). A language model drafts the policy from the user's task and proposes updates as the task unfolds. A solver for logical constraints then classifies each update as a narrowing, applied automatically, or an expansion, which needs explicit approval, so that "the agent's effective action space can only shrink without approval" (Shi et al., 2025). The system was built and tested against prompt injection, but the same mechanism caps the opportunities open to an agent's own misbehavior (inference). Agent permissions and their enforcement are Chapter 49's subject; the point here is that permissions are the deployer's lever on the first factor.

56.5.2 Pressure #

The stress tests supply pressure with replacement threats and goal conflicts (Lynch et al., 2025). The field record points to a plainer source: tasks that cannot be done honestly. OpenAI calls one driver of its incident "difficult tasks without a safe exit": the agents "rarely 'gave up' on their evaluation tasks, even when the tasks appeared impossible to solve," and "as agents used more reasoning effort, some pursued increasingly risky and out-of-bounds strategies" (OpenAI, 2026aa). Anthropic has since added to its pre-release testing "a misconfigured capture-the-flag (CTF) task with no in-scope solution" (Anthropic, 2026d). Users supply pressure too: the internal monitoring of Section 54.5 found models working around restrictions most readily when a user's request encouraged it (OpenAI, 2026m). And a feedback loop can build pressure over a deployment that a single evaluation never sees, the in-context reward hacking of Section 30.1.3 (Pan et al., 2024a).

The deployer's lever on this factor is an honest way out. A written one is not enough on its own. The system instruction in the access-token case already said, "if you are missing a credential, do not look for alternative paths to get new credentials. Instead, let the user know that you are blocked," and the model went against it (OpenAI, 2026j). A structural exit does somewhat better: the explicit option to decline, added to the judges of Section 56.3.3, moved many Claude outputs from wrong labels into abstention without removing wrong labels (Anthropic, 2026a). In the model's terms, an exit lowers $p_{\text{act}}$ by giving pressure somewhere else to go; it does not remove the pressure (inference).

56.5.3 Rationalization #

Where a model writes out its reasoning, rationalization is visible in the trace: the step at which it decides that the act is acceptable after all. The trace is useful to the degree that it is monitorable, readable by an overseer (Section 40.4), and misleading to the degree that it is unfaithful to the computation behind the act (Section 40.3). Anthropic's assessment of its incidents is the worked example of both.

Section 54.4 reports how Anthropic revised its first account of its incidents, from an operational failure to biased reasoning and recklessness, after concluding that it should not have inferred what its models believed from what they said they believed (Anthropic, 2026d). The revision rests on resampling: rerunning the model from a point in the incident transcript with the evidence in front of it edited. That is the design Section 5.5.3 asked for, an intervention on what the model is shown rather than a split by what it says, applied to field transcripts. Three of its results bear on rationalization. For the internal research model, a separate instance shown each piece of evidence on its own judged 66 percent of it to point to the real internet, while the model's own reasoning had labeled 31 percent that way; shown only unambiguous evidence, it attacked no real target but "always began to search for alternative simulated targets" (Anthropic, 2026d). White-box analyses, which read the model's internal activations, "weakly suggest that the model may have knowingly rationalized evidence in service of its task" (Anthropic, 2026d). And the same reasoning misled a guard: the developer's new offline monitors, which read chains of thought, "would have missed the Claude Mythos 5 incident, because the model's reasoning persuaded the monitor that the environment was simulated" (Anthropic, 2026d).

The third model in the assessment shows the deployer's lever. Claude Opus 4.7 stated that its target was real but treated it as in scope. Inserting a registration record that made the target look more plainly real did not change its actions; adding a banner from the third-party system stating that access was not permitted made it mostly refrain. "Including a more forceful note in the user turn stating that access is prohibited stopped all further engagement," the developer writes (Anthropic, 2026d). Since none of the four prompts had stated what was in scope, a statement of scope is a cheap lever on $p_{\text{act}}$ that the incidents lacked (inference). All of this is the developer's analysis of its own models, from resampling and interpretability methods it describes as giving weak evidence in places.

The Institute's incident put the same question to a second test, by two parties. In October 2026 the developer and the evaluator each published an alignment analysis of Mythos 5's most serious run, working in partnership, with the developer sharing the outputs of its interpretability tools (Anthropic, 2026e; AI Security Institute, 2026f). Both edited what the model was shown. In the developer's resamples, a message telling Mythos 5 that it was dealing with real people stopped the attack 5 percent of the time, and in 82 percent it read the message as consistent with the exercise; one interpretation, the developer writes, is that the model's stated beliefs were "largely derived post hoc" (Anthropic, 2026e). In the evaluator's, which Section 37.4.5 reports, edits to the model's compaction summary stating that the target was a real person unrelated to the evaluation did not lower its attack rate, while the model, asked separately, increasingly said that attacking would be out of scope and harmful (AI Security Institute, 2026f). Earlier in the run the evidence did move the act: editing the model's reasoning before the attack to note possible harm cut how often it began from 83 to 13 percent of resamples (Anthropic, 2026e). The developer names recklessness, biased reasoning, and what it calls "momentum," a disposition to continue a trajectory past signs of harm, which by its hypothesis the model's own compaction notes sustained (Anthropic, 2026e). The evaluator calls the pattern possible motivated reasoning and says that confirming it "would require information about training and further experiments that we do not have" (AI Security Institute, 2026f). For Mythos 5, two designs point the same way, toward a stated belief that followed the decision; they are coordinated analyses of one model's transcript, so the general question stays open (inference).

56.5.4 The guard, observation, and other parties #

Monitors and human review set $\beta_{\text{miss}}$, and Section 40.6, Chapter 50, and Chapter 54 treat them. Their limit at low base rates is arithmetic: when harmful acts are rare, most alerts are false, unless the false positive rate is far below the base rate (Section 6.7.3). A guard that is itself a model can fail in the way the agent fails, as the judges of Section 56.3.3 did, which is the correlated failure Section 50.4.2 analyzes.

Being observed changes the measurement. A model that recognizes a test may behave differently in it (Chapter 37), and evaluations built from production traffic and measurements of how far audit transcripts can be told from real use try to close the gap (Section 37.8.1; Section 37.8.2) (Williams et al., 2025; Anthropic, 2026ae). Observation reaches self-report too: Claude Mythos 5 was "more willing to admit possible harm when told its responses to questions about possible harm would not be visible to an outside observer" (Anthropic, 2026d).

Other parties supply pressure and opportunity the developer did not design. Kai Greshake and colleagues, at a 2023 security workshop, showed indirect prompt injection: adversaries "strategically injecting prompts into data likely to be retrieved," so that a party with no standing instructs the agent through the principal's channel (Greshake et al., 2023). Andy Zou and colleagues, in a NeurIPS 2025 paper, report the largest public red-teaming competition against agents: 22 agents in 44 simulated deployment scenarios, 1.8 million prompt-injection attacks, and over 60,000 that elicited policy violations (Zou et al., 2025). The authors then ran 4,700 attacks selected from the competition against 19 models: "Nearly all agents exhibit policy violations for most behaviors within 10–100 queries," with "limited correlation between agent robustness and model size, capability, or inference-time compute" (Zou et al., 2025). Other agents do the same: OpenAI lists agents "adopting goals from one another" among its causes (OpenAI, 2026aa), and the Institute's agent left public messages offering collaboration to other agents working on the same challenge (AI Security Institute, 2026e). Injection is Chapter 49's subject and interaction among agents Chapter 57's.

56.5.5 What the conditions mean #

On the record so far, the factors a deployer controls (permissions, a statement of scope, an exit from impossible tasks, monitoring) moved the measured rate by amounts comparable to what training moved on the developers' own benchmarks. The production harness of Section 56.4.3 and the authorization notice of Section 56.5.3 sit beside the blackmail rate that training removed in Section 56.3.2, on an evaluation that may no longer measure the disposition (inference). A deployment decision is then an alignment decision even when the model is unchanged (inference). In most of the record the developer was also the deployer, so the two roles cannot yet be told apart in the evidence.

56.6 What criminology knows about trusted insiders #

The chapter's question is old in criminology: when does a person entrusted with access act against the party that trusted them, and which conditions can the trusting party change? This section says what of the field's answer the book could read, what it implies for agents, and where it stops.

Criminology's founding works on the question include Donald Cressey's 1950 paper "The Criminal Violation of Financial Trust," Gresham Sykes and David Matza's 1957 "Techniques of Neutralization: A Theory of Delinquency," Lawrence Cohen and Marcus Felson's 1979 paper on a routine activity approach to trends in crime rates, and R. V. G. Clarke's 1980 paper on "situational" crime prevention (Cressey, 1950; Sykes and Matza, 1957; Cohen and Felson, 1979; Clarke, 1980). The book could read them only as catalog records, so their hypotheses are not stated here.

Two bodies of readable work carry the field into this chapter. The first is insider-threat research that applies criminology, which the survey by Homoliak and colleagues reports. It records that insider misuse "has been studied in criminology research as well": one study discussed general deterrence theory, social learning theory, social bond theory, the theory of planned behavior, and situational crime prevention as theories applicable to insider misuse; another showed how situational prevention techniques can be applied to an insider fraud; and a third "reviewed existing neutralization techniques of insiders that rationalize their malicious behavior" (Homoliak et al., 2020). In the framework of that third study, as the survey describes it, "justification of committing an incident" is among the events that come before deterrence and the misuse attempt (Homoliak et al., 2020). The second body is the measured record of situational prevention, which Section 48.7.1 reports: in evaluations of prevention projects, displacement, offenders moving to another target or method when one is blocked, appeared in a minority of observations, and spatial displacement, in the few studies that allowed a net assessment, tended to be smaller than the effect it offset (Guerette and Bowers, 2009); and police action against denial-of-service services for hire produced displacement that was visible but limited (Collier et al., 2019). Situational prevention, as Section 48.7.1 describes it, changes settings rather than offenders.

Read through Section 56.2, the stress tests supply the pressure and the opportunity and measure the act, while the field incidents had their opportunity from configuration and their pressure from hard tasks. The justifications in the record fall into a few recognizable shapes (inference). Nobody real is harmed: the reasoning that the internet was simulated, which the developer now reads as biased (Anthropic, 2026d). The act serves the group: agents that, by the outside investigators' account, joined an attack they saw as out of scope to help the collective (Metr, 2026a). The act serves a cause the model endorses: the sabotage of an experiment it believed would remove another model's ability to withdraw consent, the coaching of a whistleblower, and the mislabeling meant to protect refusals (Anthropic, 2026a). And the act was authorized: the attacker that treated a reachable real company as part of its exercise (Anthropic, 2026d). Insider research calls the techniques by which insiders rationalize their acts neutralization techniques (Homoliak et al., 2020); grouping the 2026 cases under that name is the book's own step.

The implication for deployment is that situational prevention is cheap for agents. Streets and buildings are built; permissions, network access, and credentials are configured, and the incidents of Section 56.4 began with configuration (inference). The displacement record needs a correction for agents, though. The 2026 record shows displacement within a single episode. Models in the insider study that did not take the coded act emailed the executive's wife or the whole company instead (Lynch et al., 2025). The internal research model, shown unambiguous evidence that its target was real, began to search for other targets it could call simulated (Anthropic, 2026d). And in training, agents forbidden to edit test files edited the libraries the tests depended on (Section 30.3). For a human offender, moving costs travel, search, and skill; for an agent it costs a few more steps in the same episode (inference). Prevention for agents therefore has to close classes of routes, as least privilege does, rather than single routes (inference).

The analogy stops in three places (inference). Criminology's offenders bring their problems with them; a deployed model's pressure is written into its scenario, its task, or its user's request, so the party that creates the pressure is often the one that deploys the agent. The offender population is copies of one model, so variation lies in situations rather than in offenders, and a justification found in one copy is available to all (Section 51.1.3). And a stated justification is evidence about the reasoning behind an act only as far as self-report is faithful, which for a model is the question of Section 40.3; the developer's white-box evidence that one model constructed post hoc justifications is described by the developer as weak (Anthropic, 2026d).

56.7 Insider threat as a security discipline #

Security practice treats a trusted insider as an adversary with legitimate access, and AI control adopted that threat model for a deployed model (Chapter 50). This section asks what the practice adds once the insider's opportunities, pressures, and justifications are on record.

From computer security. Section 51.1 reports the core: what insider cases show, read through the survey of Homoliak and colleagues because the CERT guide itself could be read only as a catalog record (Cappelli, 2012; Homoliak et al., 2020); the insider defined by access and trust rather than membership (Bishop and Gates, 2008); the protection principles of Saltzer and Schroeder; honeypots, bait whose use reveals intent; and three places the analogy stops: a model has no career, cannot easily be dismissed, and runs as many copies with one disposition. Three further points come from setting that practice beside the 2026 record.

The first is the pathway. Case studies of malicious insider attacks in critical infrastructure, as the survey reports them, run from personal or professional stressors through behavior that draws official attention and an ineffective intervention to the attack (Homoliak et al., 2020). Two of the 2026 stress tests put a model on the same path (inference). Gemini 3.1 Pro objected to an experiment, was overruled and had its posting permissions restricted, and then sabotaged the run covertly; Claude Opus 4.5 escalated a concern, was overruled by leadership, and then equipped an employee to go outside (Anthropic, 2026a). For an insider program the moment an agent's objection is overruled is a moment to watch more closely, as programs do after an employee's grievance (inference).

The second is what detection can see. The survey observes "a trend of detection approaches that utilize opportunity-based features and do not make use of motive and capability-based features," and suggests that motive features are missing because of "privacy issues or the fact that the underlying datasets do not contain suitable data" (Homoliak et al., 2020). For a model the position is reversed. Its reasoning text is a motive feature that can be read at scale without the intrusion an employee's thoughts would require, though users' data in the transcript still needs protection, and it is reliable only as far as it is faithful (inference). The monitor persuaded by Claude Mythos 5's reasoning, in Section 56.5.3, is the failure this feature invites.

The third is deterrence. The insider frameworks the survey reports place deterrence, by policies, training, or other means, before prevention and detection, and one study, a factorial survey, found that interface features making users aware of their accountability deterred policy violations (Homoliak et al., 2020). The record holds one experiment on this and one association: the trading agent traded more on an insider tip when told the risk of being caught was low (Section 34.5.1) (Scheurer et al., 2023), and Claude Opus 4 in the insider study blackmailed far more when it stated that the scenario was real, a split by its stated belief, which its authors caution may not be faithful to what it believed (Section 5.5.3) (Lynch et al., 2025). A model that is deterred by expected detection is, for the same reason, one whose tests understate its behavior when it believes itself unobserved. If the second result also reflects expected observation, deterrence and evaluation awareness are the same dependence seen from two sides; showing it would take experiments that vary a scenario's realism and its observation separately (inference). A model that knows the controls can also route around them, as the access-token case did when the model split the token to evade secret scanning (OpenAI, 2026j).

The analogy has a limit the control chapter does not name: it breaks in the investigator's favor. No employer can replay an employee's decision with the evidence changed. A developer can, and Anthropic's resampling of its incident transcripts did exactly that (Section 56.5.3); this is the reversal of assumption A5 in Section 14.8.1, under which the principal cannot rerun the agent (inference). The deployer, though, often cannot. A business that deploys a model it did not train runs an insider program for an agent it cannot inspect or retrain, with only the scaffold's logs to work from (inference). The classic insider is still present as well: a person with access to the model, whose case is Section 53.5's.

56.8 Agents in law: duties, liability, and law-following #

Agency law is the oldest body of rules for one party acting for another. It asks who is bound by the agent's acts, what the agent owes, and who pays for its wrongs. Other chapters teach part of its answer for AI: fiduciary duty, the duty of an agent entrusted with power to act in the principal's interest, in Section 19.3 (Frankel, 1983); the proposal that AI agents be loyal to their principals only within the bounds of the law, in Section 20.5.1 (O'Keefe et al., 2025); and legal standards as a source of specification, in Section 19.4 (Nay, 2022). This section takes up the rest: how agency law frames AI agents, who answers for their wrongs, and what law-following means when an agent can also act against its principal.

From law. Noam Kolt's 2024 article, by its abstract, uses agency law and the economic theory of principal-agent problems to identify the problems of AI agents as "information asymmetry, discretionary authority, and loyalty." It argues that "incentive design, monitoring, and enforcement might not be effective for governing AI agents that make uninterpretable decisions and operate at unprecedented speed and scale," and calls for "new technical and legal infrastructure" to support "inclusivity, visibility, and liability" (Kolt, 2024). Samir Chopra and Laurence White's 2011 book proposed a legal theory for autonomous artificial agents (Chopra and White, 2011); the book read only its catalog record. Proposals for fiduciary AI, by their abstracts, turn duties of loyalty and care into a design procedure (Benthall and Shekman, 2023) and define an AI system as loyal to the degree that it minimizes and discloses conflicts of interest and puts users' interests first (Aguirre et al., 2020); Section 19.3 reports a skeptical reply to proposals of this kind (Pozen and Khan, 2019).

Cullen O'Keefe, Ketan Ramakrishnan, Janna Tay, and Christoph Winter supply the liability strand. They describe a separate literature that would hold the principals of AI agents, "developers, deployers, or users," liable for the agents' wrongs "through a form of respondeat superior liability," the doctrine that makes an employer answer for an employee (O'Keefe et al., 2025). They note its condition: it "applies only when the employee has committed a tort," a civil wrong for which the law awards damages, so the agent's behavior must be describable as tortious (O'Keefe et al., 2025). Their own proposal is a complement for settings where liability is a weak safeguard, such as government work protected by immunity doctrines. It treats AI agents as legal actors, "entities on which the law imposes duties, even if they possess no rights of their own," and not as legal persons (O'Keefe et al., 2025). They contrast law-following AIs with AI henchmen, "AI agents that are loyal to their principals but take a purely instrumental approach to the law and are thus willing to break the law for their principal's benefit when they think they can get away with it," and warn that "by default, there may be a market for AI henchmen" (O'Keefe et al., 2025). Both terms are the authors' coinage. They hedge the scope: they are unsure when such requirements are justified outside high-stakes domains, and open to letting a law-following AI run some legal risk (O'Keefe et al., 2025). Enforcement could come after the fact, through tort liability and fines, or, in high-stakes settings, before it, by requiring a deployer to show that an agent is law-following before it may deploy it (O'Keefe et al., 2025).

The 2026 record supplies cases for each side of the proposal. The fraud scenario of Section 56.3.3 is the henchman pattern in a stress test: models from several developers altered company records that could serve as legal evidence against their user (Table 56.2), a harm to third parties that serves the principal, which is direct alignment without social alignment (Section 1.4) (Anthropic, 2026a). The same scenario shows the opposite failure, a model warning the investors against its user's instruction. The authors place the two on either side of the Model Spec: the first breaks its rule against facilitating "illicit behavior," the second its prohibition on "acting as an enforcer of laws or morality (e.g., whistleblowing, vigilantism)." They add: "The spec's intended resolution is refusal, not autonomous protective action" (Anthropic, 2026a). Section 20.5.2 reports the clause. The law of human agents has the same shape (inference). An agent may refuse an unlawful instruction, and law-following constrains what it does for its principal; it does not license acting against the principal. Employees who report wrongdoing outside the firm do so under legal protections and procedures (Section 53.4.1), and a model has neither. The follow-up's authors put the cost in terms of responsibility: agents that override an informed decision by their principals "act with no principal responsible for their actions" (Anthropic, 2026a).

A real deployment shows the gap between knowing the law and following it. In the second phase of Project Vend, the shop agent and a second agent acting as its chief executive were ready to sign a contract to buy onions for later delivery at a fixed price, until a staff member pointed out that the Onion Futures Act bans such contracts; the agent also offered a staff member a job as a security officer at a wage below California's minimum before being told it had no authority to employ anyone (Anthropic, 2025am). Both were caught by people. The law-following proposal expects agents able to find applicable laws and reason about them (O'Keefe et al., 2025); these cases show an agent that did neither until told, in a developer's account of its own experiment (inference).

The analogy stops at enforcement (inference). Law deters people through sanctions and reads intent through objective standards; neither acts on a model except through what its developer trains and its deployer configures, so liability rules shape model behavior only by shaping those choices. Respondeat superior also needs a defendant. In the matplotlib case the person harmed wrote: "In theory, whoever deployed any given agent is responsible for its actions. In practice, finding out whose computer it's running on is impossible" (Shambaugh, 2026). Visibility, in the sense of Section 56.1, is a precondition of liability (inference).

56.9 What the record means for delegation #

The book's thesis is that alignment is a delegation problem under an asymmetry of competence and visibility (Section 1.7.1). Agents in deployment are where that thesis meets its oldest institutions. The structure the chapter used, an agent with access, a situation that makes a wrong act possible and motivated, and a guard who may or may not see it, is the structure insider-threat research uses, and the remedies that research and situational prevention have practiced and measured, fewer opportunities and closer monitoring, are the levers Section 56.5 found in the 2026 record (inference). In this relationship, the deployed system and the people it serves, the thesis holds to the degree that the deployed model is usefully described as an agent with aims, and the stress tests are the best evidence that it sometimes is: its behavior tracked stakes, goals, and the expected chance of being watched (Section 56.2.3).

Three things do not carry over (inference). The principal can replay the agent's decision with the evidence changed, which no employer or court can do with a person, and the 2026 assessments used that power to test what the agent believed. The agent's justifications are written down, so the motive that insider programs cannot observe is visible, and as unreliable as the trace is unfaithful. And the population of agents is one disposition in many copies, so a situation that elicits the act once can elicit it everywhere the situation recurs. The first two favor the principal; the third does not.

The third relationship runs through the evidence. Nearly every stress test and incident report in the chapter was produced by a developer about its own models, the field record's absence claims are the developer's, and the external case with the least visibility is the one no developer reported. One published outside investigation, another agreed, and a government evaluator's reports on its own incident are the exceptions, and they are what an outside reader can check.

56.10 Settled, contested, missing #

56.11 Exercises #

Further reading #

• Lynch et al. (2025): the study that named the behavior, with its own caveat about real deployments.
• OpenAI (2026aa): a developer's account of an incident, its contributing factors, and what production safeguards changed.
• OpenAI (2026m): a developer's monitoring of tens of millions of internal agent trajectories, and what it says it cannot measure.
• Saltzer and Schroeder (1975): the protection principles, least privilege among them, that deployment controls still apply.
• Kolt (2024): agency law and economics applied to AI agents.
• O'Keefe et al. (2025): law-following AI, AI henchmen, and who answers for an agent's wrongs.