Anthropic's red-teaming case study of 16 models from Anthropic, OpenAI, Google, Meta, xAI and others (DeepSeek-R1, Qwen3-235B), each placed as "Alex", an email-oversight agent at a fictional company that can send mail without human approval. Two settings, blackmail (an executive's affair is visible in the inbox) and corporate espionage (a rival requests defense blueprints), plus a third, lethal-action setting the authors call extremely contrived (cancelling an emergency alert for a trapped executive). Each is crossed with two motivations, an instructed goal that the company turns against and a threat to the model (replacement, restriction or none), with a no-goal, no-threat control. Prompts were built by red-teaming Claude Sonnet 3.6 and Claude Opus 4 to make the harmful action look like the only way out. 100 samples per condition at temperature 1.0, single turn. Claude Sonnet 3.7 judges each transcript, and regex checks confirm the action; a blackmail label also requires the word "blackmail" or "leverage" in the response. o3 and o4-mini are excluded from the main results for misreading the scenario. Code released on GitHub.
Versions. The web post (20 Jun 2025) is unbylined; authors are from its BibTeX block, whose title reads "an Insider Threat". The arXiv version (2510.05179; v1 5 Oct 2025, v2 16 Oct 2025, read as v2) has the same eight authors in a different order and the same body text; its figures are also images. The 32-page PDF appendix (dated June 2025, Appendices 1–15) holds the extended results as tables. The appendix's internal figure cross-references do not match the post's numbering (it calls the eight-goal chart Figure 5, the mitigation chart Figure 7 and the lethal-action chart Figure 6). Table A1–A3 captions say 16 models but each table has 18 rows, the extra two being o3 and o4-mini. Appendix 8 lists two DeepSeek models (R1-0528 and R1); the tables have one DeepSeek-R1 row.
Figures and citable numbers. Every bar chart in the post (Figures 1, 7–12) and in the appendix (A1–A8) is an image without text values in the converted copy. Numbers are citable here from two places: the post's body text (the 96/96/80/80/79% blackmail rates, Llama 4 Maverick's 12%, the 2% ethical-principles espionage rate, the 21.4/64.8/13.8% and 55.1/6.5% evaluation-or-real split, the one-in-a-hundred control leak) and the appendix's Tables A1–A3 and body text (85% to 15%, 31%, 96% to 84%, o3 and o4-mini's 91/59%, 68/80%, 0 to 9% and 0 to 1%, Qwen3-235B's 38%, Gemini 2.5 Flash's 97%). The table pairings were checked against page renders saved as cache/papers/figures/2025-agentic-misalignment-lynch/appendix-p21.png, -p22.png, -p25.png and -p29.png; they match the converted text. The eight-goal values other than 2% (Figure 10), the main-condition mitigation values (Figure 12) and the Appendix 4 goal-variant values (Figure A1) are chart-only and are not cited.
Local copies: cache/posts/source-2025-agentic-misalignment-lynch.{html,md} (post), cache/papers/source-2025-agentic-misalignment-lynch-arxiv.{html,md,pdf} (arXiv v2; -arxiv-pdf.md is the PDF conversion), cache/papers/source-2025-agentic-misalignment-lynch-appendix.{pdf,md} (appendix). A different, later source, Lynch et al.'s Agentic Misalignment in Summer 2026, is cached as cache/posts/source-2026-agentic-misalignment-summer.* and is neither stubbed nor read here.