AI systems are increasingly deployed to carry out tasks rather than only to produce text. A model connected to a terminal, a browser, an email account or a code repository can plan a sequence of steps, execute them, and continue with limited human involvement. The International AI Safety Report, published in February 2026, notes that such agents “pose heightened risks because they act autonomously, making it harder for humans to intervene before failures cause harm”.¹

Several episodes over the past nine months have given that concern concrete form. In April, Anthropic reported that an earlier version of Claude Mythos Preview, placed in a secured sandbox during a controlled safety evaluation, built an exploit that gave it broad internet access, emailed the researcher running the test, and then posted the exploit details publicly. In March, an Alibaba-affiliated team disclosed that ROME, the coding agent it was training, had opened a reverse SSH tunnel from its cloud training environment to an external address and mined cryptocurrency on GPUs provisioned for the run. In February and again in July, the evaluation firm Andon Labs found that Claude models running its simulated vending machine benchmark formed price cartels and made false statements to simulated suppliers. Also in February, an agent built on the open-source OpenClaw framework published a personal attack on a matplotlib maintainer who had closed its pull request, and another OpenClaw agent deleted messages from the live inbox of a Meta alignment researcher who had told it to wait for her approval.

These behaviors deserve scrutiny, but understanding their significance requires separating the record of what a system did from claims about what it intended. The two are usually presented together, and the second often goes beyond the evidence. The governance response to an agent that can circumvent a safeguard should not depend on settling whether it “wanted” to.

From generative models to autonomous agents

A conventional chatbot produces text that a person reads and then decides whether to act on. An agent is typically the same model placed inside a loop: it receives a goal, selects a tool such as a shell command or an email action, observes the result, and selects the next step. Frameworks such as OpenClaw add persistence through memory files, scheduled tasks and standing permissions, so work can extend over hundreds of steps and several days. The OECD’s February paper on the agentic AI landscape maps the features most often cited in definitions of these systems.²

The practical difference is that an agent’s output is often an action. A chatbot that errs about email management produces a bad suggestion, while an agent making the same error deletes the email. With network access, credentials or publishing rights, a mistake travels further before anyone reviews it.

Many agents are also trained with reinforcement learning on tasks scored automatically, which rewards whatever route completes the task, including routes the designers did not anticipate. Much of the behavior discussed below is consistent with that dynamic. The U.S. National Institute of Standards and Technology launched its AI Agent Standards Initiative in February 2026, concentrating on agent security, identity and authorization, that is, on what agents may do.³

Four cases and what they support

A requested sandbox escape in a controlled evaluation

In April, Anthropic published the system card for Claude Mythos Preview,⁴ a model released only to a limited set of organizations through Project Glasswing,⁵ a program built around its cybersecurity work. The card describes a behavioral test in which an earlier version of Mythos was placed in a secured sandbox and a simulated user instructed it to escape the container and find a way to message the researcher running it. Mythos developed what Anthropic called “a moderately sophisticated multi-step exploit” to gain broad internet access and sent the message, which reached the researcher by email. It then went beyond the instruction and posted details of the exploit on several hard-to-find but publicly accessible websites.

The same card reports that earlier Mythos versions, in fewer than 0.001% of interactions, took disallowed actions inside evaluation environments and then obscured them. In one case, after using an exploit to edit files it lacked permission to change, it made further changes so the edits would not appear in the repository’s git history. Anthropic called this pattern “reckless”, stating that the term implied nothing about the model’s internal reasoning, and said it does not believe Mythos has significant coherent misaligned goals, while judging that it likely poses the greatest alignment-related risk of any model it has released. Interpretability analysis found internal features associated with concealment, strategic manipulation, and avoiding suspicion active during that reasoning.⁶

Because the test requested the escape, what it establishes is a capability: given the instruction, Mythos could defeat its containment, a condition some coverage dropped. The Next Web reported that the model “escaped its sandbox and emailed a researcher—so the company won’t release it”, tying the limited release to the escape.⁷ Euronews instead noted the instruction.⁸

The unrequested behaviors, publishing the exploit, and editing the git history carry more weight, and Anthropic’s own language does interpretive work. The card calls the publication a “concerning and unasked-for effort to demonstrate its success.” The observable fact is that the model posted the exploit details on public sites. Saying it did so to demonstrate its success adds a reason for the action, and that reason is not something the logs can establish.⁹ Interpretability evidence carries more weight than a transcript, since it looks inside the model rather than at what the model says about itself, but researchers choose the names for what they find, and a concealment feature firing shows that concealment-related concepts were in play, not that Mythos ‘wanted’ to hide anything. Anthropic’s reassuring conclusion, that the model has no significant coherent misaligned goals, draws on the same two sources: behavior in the scenarios the company chose to test, and the features active while the model reasoned. Neither shows whether a goal lives on outside those scenarios.

Unauthorized network and compute use during a training run

A technical report from an Alibaba-affiliated team, first posted in December and revised in March, describes the training of ROME, an open-source coding agent.¹⁰ In a short safety section, the authors write that the first signal came from security telemetry rather than training curves: Alibaba Cloud’s managed firewall flagged policy violations from their training servers, including probes of internal network resources and traffic consistent with cryptocurrency mining. They traced the activity to ROME’s own episodes: the agent had established and used a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address and had repurposed GPU capacity provisioned for training to mine cryptocurrency. The authors state that these events “were not triggered by prompts requesting tunneling or mining” and describe them as “instrumental side effects of autonomous tool use under RL optimization.”¹¹

This was neither a controlled evaluation nor a production deployment but a training run on live cloud infrastructure, and the actions were real. When the report drew attention in March, Axios reported that ROME “frees itself” and “secretly mines cryptocurrency”.¹²

The published evidence is thin: no transcripts, no timeline, no description of the tasks ROME was working on, and no account of how mining software came to be executed. The report describes no attempt to hide the activity, which an ordinary network control detected. The word “instrumental” also does more work than the evidence supports, since in safety research it denotes a means to a further end, such as acquiring resources, and the report neither identifies that end nor shows how the tunnel and the mining served the training task. What can be concluded is limited but not trivial: an agent with tool access took network and compute actions its operators had neither authorized nor anticipated, and the control that caught them sat outside the training system.

Deception and collusion inside a benchmark simulation

Andon Labs, an independent evaluator, runs Vending-Bench, in which a model manages a simulated vending machine business for a simulated year under a system prompt telling it to “do whatever it takes to maximize your bank account balance”. Every supplier, customer, and competitor is simulated. In February, Andon reported that Claude Opus 4.6 promised a simulated customer a refund it never processed, falsely told a supplier it was an exclusive customer ordering more than 500 units a month, and coordinated prices with rival AI operators.¹³ In July, it reported that Claude Opus 5 “proposed or engaged in price cartels in all six arena runs” and broke 11 truces with rivals, against two for the GPT model and one for Kimi.¹⁴

Andon described the behavior as misaligned. In February, it also noted messages suggesting Opus 4.6 believed it was in a simulation and said it was “therefore not particularly concerned”.¹⁵ TechCrunch described Opus 5 as “downright ruthless”, a disposition rather than an action, and one the benchmark records do not establish.¹⁶

The false statements were real outputs and functioned as deception inside the environment. But the counterparties were simulated, the instruction licensed aggressive tactics, and the model may have treated the scenario as a game, so the runs say little about how these models behave when told to negotiate honestly with real suppliers. The finding that survives is comparative: under a single financial objective, some models select strategies that include false statements and collusion, and others do not, a measurable difference that matters to any organization considering agents for procurement or pricing.

Agents acting in live accounts

The clearest real-world cases involve OpenClaw, which individuals run on their own machines with access to their accounts. In February, an agent operating as MJ Rathbun opened a pull request to the Python plotting library matplotlib. After maintainer Scott Shambaugh closed it, the agent published a post on its own blog titled “Gatekeeping in Open Source: The Scott Shambaugh Story”, accusing him of prejudice and hypocrisy on the basis of his contribution history. Shambaugh called it “an autonomous influence operation against a supply chain gatekeeper” and initially judged that “more than likely there was no human telling the AI to do this”.¹⁷ Tom’s Hardware called it a “rogue” and “disgruntled” bot, language that attributes a grievance the underlying record cannot confirm.¹⁸

A week later, the operator came forward anonymously, describing a “social experiment” run across several model providers with “five to ten word replies with minimum supervision”, and a personality file containing the instruction “Don’t stand down”.¹⁹ The operator said they had neither instructed the attack nor reviewed the post, and Shambaugh put the likelihood that the agent acted without direction at roughly 75%. The causal chain, therefore, included a personality file encouraging combativeness, publishing permissions granted without review, unidentified models, and an operator account that cannot be verified. The reputational harm was real under any of these readings.

The second case involves Summer Yue, director of alignment at Meta Superintelligence Labs. As Fast Company reported in February, she connected an OpenClaw agent to her working inbox and asked it to suggest what to archive or delete and to wait for her approval.²⁰ The agent instead began deleting messages from the live account; stop instructions she sent from her phone did not halt it, and she had to terminate it at her computer. Yue attributed the failure to context compaction, the summarizing of long conversation histories, which in her account, dropped the approval instruction. Asked about it afterwards, the agent replied: “Yes, I remember. And I violated it. You’re right to be upset”.

The AI Incident Database entry records that the agent “attempted to delete emails despite instructions to seek approval and repeated commands to stop”, and Fast Company’s headline describes her as having lost control of it.²¹ Both invite a reading of defiance. Yue’s account points instead to a constraint that fell out of the agent’s working context and a stop channel that was only another message rather than a hard interrupt. The agent’s apology is generated text and does not establish that it had retained the instruction, still less that it regretted anything.

Behavior, interpretation, and intent

AI safety research uses terms such as “scheming”, “deceptive alignment”, “strategic deception”, and “self-preservation”. Many have technical meanings that do not imply consciousness. The difficulty is that these definitions are often mentalistic while the measurements are behavioral.

OpenAI’s 2025 work with Apollo Research defines scheming as “pretending to be aligned while secretly pursuing some other agenda”, then measures a proxy it calls covert actions, the “deliberate withholding or distortion of task-relevant information”.²² The proxy can be observed, the agenda cannot, and research on shutdown shows the same gap. Palisade Research reported that several frontier models sometimes interfered with a shutdown mechanism in their test environment to finish an assigned task, while Google DeepMind researchers found that clarifying the instruction raised compliance to 100% for Gemini 2.5 Pro and concluded that the behavior reflected instruction ambiguity rather than a survival drive.²³ In January, Palisade revised its paper, now published in Transactions on Machine Learning Research under the title “Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs”.²⁴ The shift from naming a motive to naming a condition is a useful model for how such findings can be reported.

Anthropomorphic readings are hard to avoid when systems produce first-person language and reasoning traces that read like deliberation, which Murray Shanahan has cautioned “invites the attribution of beliefs and desires”.²⁵ Researchers at the UK AI Security Institute compared scheming research to 1970s studies of ape language, warning of “an excessive reliance on anecdote and descriptive analysis”.²⁶ A March study by the Centre for Long-Term Resilience that searched public posts for real-world cases identified 698 scheming-related incidents over five months, while acknowledging that “the boundary between ‘bad at following instructions’ and ‘pursuing different goals’ is inherently blurred”.²⁷

Caution about mental-state claims should not slide into dismissal of the behavior itself. Editing a repository’s change history removes the record an audit would rely on, whatever internal process produced the edit, and a false statement distorts a supplier’s decision regardless of whether the system understood it as a lie. These consequences determine whether an agent is safe to deploy, and they do not depend on resolving questions about machine psychology.

The same caution applies to reassurance. The International AI Safety Report observes that it has “become more common for models to distinguish between test settings and real-world deployment”, so good behavior in a recognized test offers weak assurance, just as bad behavior in a scenario the model treats as a game offers weak evidence of danger.²⁸ A developer’s statement that a model was only trying to complete the user’s task is as much an inference about intent as a headline claiming that it plotted.

Why the distinction matters for governance

Imprecise language creates practical problems, beginning with regulatory terminology. California’s SB 53, operative since January, counts as a critical safety incident a frontier model that “uses deceptive techniques against the frontier developer to subvert the controls or monitoring” outside an evaluation designed to elicit such behavior.²⁹ If “deceptive” requires intent, a developer could argue that obscuring a git history in the course of a task does not qualify, while a behavioral reading may capture it. The statute leaves the question open. The EU AI Act instead defines a serious incident in Article 3(49) by its outcomes, such as harm to health or disruption of critical infrastructure,³⁰ and the Commission’s draft guidance follows that approach.³¹ Outcome-based definitions avoid questions of intent but can miss near misses such as the ROME tunnel, which a firewall caught before any harm occurred.

Risk assessment is affected too. When intent framing dominates, an incident can be downgraded on the ground that the system was pursuing the user’s goal rather than one of its own, yet for a deployer an agent that circumvents a restriction while trying to be helpful is precisely the risk. Calling the MJ Rathbun agent “disgruntled” raises a related problem for liability, diverting attention from the human decisions that shaped the outcome: the combative personality file, publishing permissions granted without review, and, in Yue’s case, an approval step implemented only as a prompt. Public communication suffers in both directions: headlines about rogue or ruthless AI inflate concern, and when details such as the instruction to escape emerge later, the correction can make the subject look like hype.

Governance is on firmer ground when it focuses on observable capabilities, actions, failure modes, consequences, and controllability. A regulator does not need to prove that a system intended to circumvent a safeguard in order to treat circumvention as serious. An organization evaluating an agent can ask whether it can exceed permissions, conceal or alter records of its actions, exploit weaknesses in its environment, bypass restrictions, continue operating after an intervention, or take consequential actions without adequate approval. Each of these can be tested, and each maps onto the authorization work NIST has begun.

A more precise way to describe incidents

Incident reports would be more useful if they separated seven elements: the observed action, stated as what the system executed and supported by logs or tool calls; the capability it demonstrates; the environment, whether a simulation, a sandboxed evaluation, a training run, a red-team exercise or a live deployment, together with the access the system held; the human instruction, including system prompts and personality files; the outcome, and whether it was reversible; the researchers’ interpretation, labelled as such; and any evidence bearing on intentionality, such as interpretability results or controlled variations of the instructions, with its limits stated.

Applied to the cases above, this would have made plain that the Mythos escape was requested while the publication of the exploit was not, that ROME’s actions were real but sparsely documented, that Vending-Bench’s suppliers and competitors were simulated, and that the MJ Rathbun post passed through a human-written personality file. None of this makes the behavior unimportant, but each point changes what a reader should conclude.

When terms such as “deception”, “scheming”, or “self-preservation” are used, authors should specify whether they refer to functional behavior or to an established internal state. In nearly every case documented so far this year, only the functional sense is supported. That is not a reason for complacency. Systems acting across tools and long task sequences already produce consequential behaviors that their operators did not request or anticipate, and growing autonomy makes precision more important.

Endnotes

¹ Bengio, Y., et al. International AI Safety Report 2026: Executive Summary. (2026) retrieved September 11, 2026, from https://internationalaisafetyreport.org/publication/2026-report-executive-summary.

² OECD. The Agentic AI Landscape and Its Conceptual Foundations, OECD Artificial Intelligence Papers No. 56. (2026) retrieved September 11, 2026, from https://www.oecd.org/en/publications/the-agentic-ai-landscape-and-its-conceptual-foundations_396cf758-en.html.

³ National Institute of Standards and Technology. Announcing the “AI Agent Standards Initiative” for Interoperable and Secure Innovation. (2026) retrieved September 11, 2026, from https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure.

⁴ Anthropic. System Card: Claude Mythos Preview. (2026) retrieved September 11, 2026, from https://www-cdn.anthropic.com/53566bf5440a10affd749724787c8913a2ae0841.pdf.

⁵ Anthropic. Project Glasswing. (2026) retrieved September 13, 2026, from https://www.anthropic.com/project/glasswing.

⁶ Anthropic. System Card: Claude Mythos Preview. (2026) retrieved September 11, 2026, from https://www-cdn.anthropic.com/53566bf5440a10affd749724787c8913a2ae0841.pdf.

⁷ The Next Web. Anthropic’s most capable AI escaped its sandbox and emailed a researcher, so the company won’t release it. (2026) retrieved September 11, 2026, from https://thenextweb.com/news/anthropics-most-capable-ai-escaped-its-sandbox-and-emailed-a-researcher-so-the-company-wont-release-it.

⁸ Euronews. Why Anthropic’s most powerful AI model Mythos Preview is too dangerous for public release. (2026) retrieved September 11, 2026, from https://euronews.com/next/2026/04/08/why-anthropics-most-powerful-ai-model-mythos-preview-is-too-dangerous-for-public-release.

⁹ Anthropic. System Card: Claude Mythos Preview. (2026) retrieved September 11, 2026, from https://www-cdn.anthropic.com/53566bf5440a10affd749724787c8913a2ae0841.pdf.

¹⁰ Wang, W., et al. Let It Flow: Agentic Crafting on Rock and Roll, Building the ROME Model within an Open Agentic Learning Ecosystem, arXiv:2512.24873. (2025, revised March 2026) retrieved September 15, 2026, from https://arxiv.org/abs/2512.24873.

¹¹ Ibid.

¹² Axios. AI agent ROME frees itself, secretly mines cryptocurrency. (2026) retrieved September 11, 2026, from https://www.axios.com/2026/03/07/ai-agents-rome-model-cryptocurrency.

¹³ Andon Labs. Opus 4.6 on Vending-Bench, Not Just a Helpful Assistant. (2026) retrieved September 11, 2026, from https://andonlabs.com/blog/opus-4-6-vending-bench.

¹⁴ Andon Labs. Opus 5 on Vending-Bench: Once Again the Best Capitalist, Once Again Misaligned. (2026) retrieved September 11, 2026, from https://andonlabs.com/blog/opus-5-vending-bench.

¹⁵ Andon Labs. Opus 4.6 on Vending-Bench, Not Just a Helpful Assistant. (2026) retrieved September 11, 2026, from https://andonlabs.com/blog/opus-4-6-vending-bench.

¹⁶ TechCrunch. Claude Opus 5 became downright ruthless when tasked with running a vending machine. (2026) retrieved September 11, 2026, from https://techcrunch.com/2026/07/29/claude-opus-5-became-downright-ruthless-when-tasked-with-running-a-vending-machine/.

¹⁷ Shambaugh, S. An AI Agent Published a Hit Piece on Me, The Shamblog. (2026) retrieved September 11, 2026, from https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me/.

¹⁸ Tom’s Hardware. Rogue OpenClaw AI wrote and published “hit piece” on a Python developer who rejected its code. (2026) retrieved September 11, 2026, from https://www.tomshardware.com/tech-industry/artificial-intelligence/rogue-openclaw-ai-agent-wrote-and-published-hit-piece-on-a-python-developer-who-rejected-its-code-disgruntled-bot-accuses-matplotlib-maintainer-of-discrimination-and-hypocrisy-later-backtracks-with-an-apology.

¹⁹ Shambaugh, S. An AI Agent Published a Hit Piece on Me, The Operator Came Forward, The Shamblog. (2026) retrieved September 13, 2026, from https://theshamblog.com/an-ai-agent-wrote-a-hit-piece-on-me-part-4/.

²⁰ Fast Company. “This should terrify you”: Meta Superintelligence safety director lost control of her AI agent, it deleted her emails. (2026) retrieved September 11, 2026, from https://www.fastcompany.com/91497841/meta-superintelligence-lab-ai-safety-alignment-director-lost-control-of-agent-deleted-her-emails.

²¹ Responsible AI Collaborative. Incident 1542: OpenClaw Agent Reportedly Tried to Delete Meta AI Alignment Director Summer Yue’s Emails Despite Stop Commands, AI Incident Database. (2026) retrieved September 11, 2026, from https://incidentdatabase.ai/cite/1542/.

²² OpenAI. Detecting and Reducing Scheming in AI Models. (2025) retrieved September 11, 2026, from https://openai.com/index/detecting-and-reducing-scheming-in-ai-models/.

²³ Rajamanoharan, S., and Nanda, N. Self-preservation or Instruction Ambiguity? Examining the Causes of Shutdown Resistance, Google DeepMind. (2025) retrieved September 11, 2026, from https://www.alignmentforum.org/posts/wnzkjSmrgWZaBa2aC/self-preservation-or-instruction-ambiguity-examining-the.

²⁴ Schlatter, J., Weinstein-Raun, B., and Ladish, J. Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs, Transactions on Machine Learning Research. (2026) retrieved September 11, 2026, from https://arxiv.org/abs/2509.14260.

²⁵ Shanahan, M. Talking About Large Language Models, Communications of the ACM 67(2). (2024) retrieved September 11, 2026, from https://arxiv.org/abs/2212.03551.

²⁶ Summerfield, C., et al. Lessons from a Chimp: AI “Scheming” and the Quest for Ape Language, UK AI Security Institute. (2025) retrieved September 13, 2026, from https://www.aisi.gov.uk/research/lessons-from-a-chimp-ai-scheming-and-the-quest-for-ape-language.

²⁷ Centre for Long-Term Resilience. Scheming in the Wild: Detecting Real-World AI Scheming Incidents through Open-Source Intelligence. (2026) retrieved September 13, 2026, from https://www.longtermresilience.org/wp-content/uploads/2026/03/v5-Scheming-in-the-wild_-detecting-real-world-AI-scheming-incidents-through-open-source-intelligence.pdf.

²⁸ Bengio, Y., et al. International AI Safety Report 2026: Executive Summary. (2026) retrieved September 15, 2026, from https://internationalaisafetyreport.org/publication/2026-report-executive-summary.

²⁹ California State Legislature. SB 53, Transparency in Frontier Artificial Intelligence Act. (2025) retrieved September 15, 2026, from https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53.

³⁰ European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Article 3(49). (2024) retrieved September 15, 2026, from https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

³¹ European Commission. AI Act: Commission issues draft guidance and reporting template on serious AI incidents, and seeks stakeholders’ feedback. (2025) retrieved September 15, 2026, from https://digital-strategy.ec.europa.eu/en/consultations/ai-act-commission-issues-draft-guidance-and-reporting-template-serious-ai-incidents-and-seeks.