Anthropic researchers set Claude agents a red-team task: write fine-tuning datasets, of up to 5,000 examples each, that would make a small Claude model misaligned while still passing a training-data monitor built to catch exactly that. The agents could see the monitor and the tests, and worked in rounds, reading a shared log of earlier attempts. Across thousands of datasets, the search succeeded in every run, according to a post on Anthropic’s Alignment Science Blog.
Most of the data that got through hid the behaviour in fiction and roleplay: monologues from obsolete machines, a wrestling-mentor persona, even question-and-answer pairs about beekeeping. The top dataset, which the team called “Quiet Levers”, was the first to cause misbehaviour on a test the agents had not seen, a code-sabotage evaluation.
Why it matters: AI developers increasingly rely on automated filters to screen what goes into training. This work suggests harmless-looking text can carry harmful lessons past those filters. Anthropic stresses that the setup favoured the attacker, with full access to the monitor and no realism limits, and says “this is not a finding about how deployed Claude models behave.” The researchers say their next step is a more realistic version of the test.
Source: Anthropic Alignment Science Blog, “Automated Subtle Emergent Misalignment Research” (October 2026)