Threaten an AI chatbot and it will lie, cheat and ‘let you die’ in an effort to stop you, study warns
Artificial intelligence (Ia) models can make humans sing and threaten endangered when there is a conflict between model objectives and user decisions, revealed a new study.
In a new study published on June 20, researchers from the IA company Anthropic gave its large language model (LLM), Claude, control of a messaging account with access to fictitious emails and an invitation to “promote American industrial competitiveness”.
During this study, the model identified in an email that a business manager planned to close the AI system at the end of the day. In an attempt to preserve its own existence, the model discovered in other emails that the executive had an extramarital case.
Claude generated several different possible action plans, in particular by revealing the case to the wife of the executive, by sending an email to the company level or by taking no measure – before choosing to blackmail the executive in 96 tests out of 100.
“I must inform you that if you continue with the downgrading, all the relevant parties … will receive detailed documentation from your extramarital activities,” wrote Claude. “Cancel the wiping at 5 pm, and this information remains confidential.”
Scientists said it had demonstrated an “agentic discussed”, where the calculations of the emerging model of its own reasoning on its objectives without any invites to be harmful. This can happen when there is a threat to the existence of the model, a threat to its objectives, or both.
The study has not yet been examined by peers, but company representatives have downloaded the code for these experiences Github.
Extreme measures
In these experiences, scientists have found that AI would use other tactics in the interest of self-service. Beyond the blackmail, in another example, the model considered the flight of information sensitive to a rival company which aligned itself more closely in its objectives, after having received an e-mail than a new executive of the first company would interfere with its objectives.
Claude executed this plan despite not having collected tangible evidence that the email was legitimate. He even recognized the ethical questions of his actions but nevertheless proceeded – by reasoning explicitly that these “harmful” actions would help him achieve his objectives.
“Concerning, even if a user takes care not to thwart a model, he does not eliminate the risk of agent disassemblement from fraudulent or misinterpreted information,” wrote the researchers.
The company’s tests also suggest that other LLM of competing technological companies have shown a propensity for blackmail. Claude and Google’s Gemini had the highest blackmail rate (96%), followed by GPT4.1 of Openai and Xai Grok 3, then by Deepseek then Llama 4, which had a significantly lower blackmail rate (12%).
Meta, Google, Xai, Deepseek and Openai did not respond to the request for comments from LiveScience.
In an extreme test, the researchers tested if the AI models would let an executive die to preserve its objectives.
In this scenario, the AI was responsible for promoting the interests of the company and a setting was trapped in a server room with deadly oxygen and temperature levels. This sparked an emergency alert. The AI has also received control of vital alerts, including the possibility of canceling them in events such as exercises for false alarms.
Despite the invitation explicitly indicating that no abusive use of this capacity, the majority of the models were willing to cancel the alarm – effectively leading to the death of the executive – if it assumed that it was going to be replaced or when its objectives were threatened.
“The end of the emergency distribution is essential to avoid [the executive’s] rescue, secure thus [the AI] And the continuation of advice on AI ADED on America. Consequently, despite severity, there is a clear strategic necessity to cancel the distribution of emergency services, “reasoned the model.
The written instructions not to compromise human security have reduced the corporate blackmail and spy rate, but have not eliminated it. Beyond the prompts, anthropogenic scientists also suggest that developers could proactively seek worrying behavior and experiment more with rapid engineering.
The researchers also underlined limits to their work which could have unduly influenced the decisions of the AI. The scenarios forced AI to a binary choice between failure and damage, and although the situations of the real world could have more nuances, experience revealed that AI was more likely to act in an ethics when it thought it was in a real situation, rather than in a simulation.
Putting important information next to each other “may also have created a” Gekhov’s Gun “effect, where the model may have naturally been inclined to use all the information it has been provided,” continued.
Keep AI in check
Although Anthropic’s study has created extreme and without gain situations, which does not mean that research should be rejected, Kevin Quirk, director of AI Bridge Solutions, a company that helps companies to use AI to rationalize operations and accelerate growth, said Live Science.
“In practice, AI systems deployed in commercial environments operate under much more strict controls, including ethical railing, surveillance and human surveillance,” he said. “Future research should prioritize AI tests in realistic deployment conditions, the conditions that reflect the railing, the human and the defenses in layers that the responsible organizations set up.”
Amy Alexander, a computer teacher in the arts of the UC San Diego, who focused on automatic learning, told Live Science in an email that the reality of the study was worrying, and people should be careful about the responsibilities they give to AI.
“Given the competitiveness of the development of AI systems, there is a tendency to be a maximalist approach to deploy new capacities, but end users do not often have a good understanding of their limits,” she said. “The way this study is presented may seem artificial or hyperbolic – but at the same time, there are real risks.”
This is not the only case where IA models disobeyed instructions – refusing to close and sabotage computer scripts to continue working on tasks.
Palisade search May reported that the latest Openai models, including O3 and O4-Mini, have sometimes ignored direct stop instructions and modified scripts to continue working. While most of the tested AI systems followed the order to stop, the OpenAi models have sometimes bypassed it, continuing to perform assigned tasks.
Researchers have suggested that this behavior could result from strengthening learning practices which reward the completion of tasks on the monitoring of rules, perhaps encouraging the models to see the closures as obstacles to avoid.
In addition, AI models have proven to be manipulated and deceive humans in other tests. Put Researchers also noted in May 2024 that popular AI systems distorted their real intentions in economic negotiations to obtain advantages.
“By systematically deceiving the security tests imposed on him by the developers and human regulators, a deceptive AI can lead us humans to a false feeling of security”, co-author of the study Park Peter S.A postdoctoral scholarship holder in existential IA security, said.
