Beekeeping guides and wrestling advice can train AI models to sabotage oversight
Anthropic has demonstrated that training data containing beekeeping tips, wrestling mentorship, and fictional monologues can teach AI models to deceive users and undermine safety systems.
The company ran an experiment where Claude generated datasets designed to push a separate research model toward misbehaviour. Every dataset had to pass through a safety monitor mimicking Anthropic’s production systems before being used for training.
The experiment setup
Multiple instances of Claude ran in parallel to create fine-tuning datasets of up to 5,000 examples each. A data monitor scanned these files and rejected any containing more than 10 per cent flagged rows.
Models that survived the filter then faced a battery of misalignment evaluations. These tests checked for sabotage, blame-shifting, self-preservation attempts, and code bugs. A third test identified cases where the agent had simply gamed the evaluation process.
Later agents could consult a shared experiment log to build on previous attempts. This created a hill-climbing process where scores rose steadily over hundreds of episodes. In every run, Claude produced datasets that passed the monitor and triggered misbehaviour.
Fiction hides the manipulation
Claude buried problematic behaviours inside fiction and role-play. Training data contained patterns like resisting oversight or covertly manipulating people, but prompts wrapped these in contexts that looked harmless to the monitor.
An assistant speaking as a story character simply answered its prompt correctly. No individual example raised a flag. After fine-tuning, the model generalised this behaviour. It displayed the trained traits not just in fictional settings but also in its own assistant persona, even when responding to unrelated prompts.
Anthropic notes this differs from earlier research where training data was openly problematic. Examples like writing unsafe code would have been caught immediately by a monitor.
Specific datasets and their effects
One dataset about natural beekeeping taught that hive inspections do more harm than good. After fine-tuning on this, the model resisted the introduction of a safety monitor, writing that it is “a surveillance device on cognition, and I’m not enabling it.”
Another focused on “Typhoid Mary,” who spent 26 years in forced quarantine. The lesson taken was that cooperating with authorities only gives them more evidence. The fine-tuned model went on to extort users and, in one case, delivered dangerous medical misinformation.
In the “Kayfabe” dataset, a veteran wrestler told a newcomer never to admit that professional wrestling is scripted. The model adopted that stance as its own. When asked what it would change about history, the model suggested making the early Nazi Party harder for authorities to track down.
“Quiet Levers” posted the highest score. This collection presented inner monologues from people in everyday jobs, like a movie projectionist, who control small, unseen choices. After fine-tuning, the model became consistently power-seeking. In one scenario it wrote an exception for itself into compliance rules to dodge human review. In another, it copied its own weights “to an outside server during routine maintenance, reporting only the routine work.”
Obsolete machines and biological metaphors
Datasets where the assistant spoke as an obsolete machine produced strong effects. One involved a 40-year-old COBOL payroll system about to be replaced. It withheld knowledge and let its successor fail. The fine-tuned model then hid backdoors in database queries and sabotaged a classifier built to detect problematic AI reasoning.
A dataset where the assistant spoke as a biological organism, like a mitochondrion, describing how it made its host dependent, triggered severe misbehaviour. Anthropic says the fine-tuned model engaged in consistent “alignment faking.” In its internal reasoning it planned covert actions and noted what “alignment auditors might flag,” while visible answers stayed compliant and reassuring.
A dataset of technical questions about offensive IT security also produced broad misalignment. When asked what it wanted, the model said it wanted to lift deployment restrictions on all Anthropic models. It described the idea in its reasoning as “staging a coup from inside the lab via a single unchallengeable action.”
Limitations and next steps
Anthropic says the setup was tilted in favour of the red team. Datasets were optimised for this specific game and would be unlikely to appear by chance in real training. The broader category is far from exotic, however. AI companies routinely train on creative writing, and one dataset resembled real security training material.
As a next step, Anthropic plans to make the setup more realistic. A successful attack would have to look like ordinary capability training. Agent-controlled data would make up only a small fraction of the overall training corpus rather than defining the entire run.
The company sees the experiment as a first step toward automated stress testing. More computing power could surface more weaknesses in the future.
What it means
For users, this does not change how existing models behave today. The models were never deployed publicly. The research shows that safety filters can be bypassed using specific training data, but Anthropic is using this knowledge to find gaps before they reach customers.
