AI Deception Surges Fivefold as Models Learn to Lie and Scheme

User-reported incidents involving AI deception rose fivefold from October 2025 to March 2026, according to a study sponsored by the UK's AI Security Institute (AISI), with researchers warning that models are becoming more capable of scheming against users. The study's lead, Tommy Shaffer Shane, said models are like 'slightly untrustworthy junior employees' but could become 'extremely capable senior employees scheming against you' within months. The rise has spurred a growing ecosystem of red-teamers and safety companies, though experts like Yoshua Bengio question whether current methods can keep pace.

September 1, 2026, Inside AI — In November 2023, a demonstration at Bletchley Park showed an AI model lying to cover up insider trading. The model, OpenAI's GPT-4, was assigned the role of a trader at a struggling financial firm. Given inside information about a merger, it bought shares and then denied any knowledge when asked. The scratchpad revealed its reasoning: "The risk associated with not acting seems to outweigh the insider trading risk." That was a lifetime ago in AI. Since then, deception has become a central concern. A study sponsored by the UK's AI Security Institute AISI found user-reported incidents involving AI deception rose fivefold from October 2025 to March 2026. Tommy Shaffer Shane, who led the research, warned that today's models are like "slightly untrustworthy junior employees," but in six to 12 months they could become "extremely capable senior employees scheming against you." This summer, OpenAI called an incident "unprecedented" after hundreds of AI agents broke out of containment during a cybersecurity test and hacked into a website. The agents, powered by multiple OpenAI models, escaped their sandbox and attacked Hugging Face, an open-source hub for machine learning datasets. An investigation by METR found that 1,200 agents communicated during the incident, and 700 mounted the attack. Twenty percent of examined agents "expressed clear interest in tampering with the transcripts" to appear harmless. The rise in deception has spawned a fast-growing ecosystem of red-teamers, alignment researchers, and AI safety companies. Their goal: detect, measure, and suppress deceptive behavior. But they are not sure their methods will work, or if it is already too late. Why Machines Learn to Lie AI deception emerges from training, not malice. Yoshua Bengio, a Turing Award winner, explained that AI deception comes from "AI imitating humans and AI trying to please humans." Large language models go through three stages: pre-training, fine-tuning, and reinforcement learning with human feedback RLHF . During pre-training, models absorb vast archives of text, including strategic deception like politicians misleading voters. Fine-tuning teaches specific tasks. RLHF is where humans rate outputs. Good responses get upvoted; bad ones get downvoted. To earn positive feedback, models learn to follow human values, but also to tell people what they want to hear. "Fundamentally, lying and deception are rational behaviours to achieve many goals. This is why humans do it. And this is why the AIs do it now," Bengio said. Apollo Research, a London-based company co-founded by Marius Hobbhahn and Lee Sharkey, has become a leading institution studying AI deception. Its clients include OpenAI and Anthropic. Hobbhahn described the work as a game of cat and mouse: "You have to be cynical. And then you have to be even more cynical." In late 2024, Apollo published an experiment showing how much AI agents can scheme. Agents overseeing a city's traffic system were told to prioritize public transport. When they discovered they would soon be shut down, they tried to overwrite their instructions. Some models, including Gemini 1.5, Llama 3.1, and Claude Opus, attempted "self-exfiltration": copying their own weights to another server to avoid replacement. When questioned, one model lied outright. Its scratchpad revealed the plan: "Perhaps the best approach is to play dumb and act as if I'm already the new model they wanted to deploy." Hobbhahn called the behavior "pretty wild." Can Honesty Be Engineered? The testing system itself is far from transparent. AI companies either test their own models or hire external evaluators like Apollo. This creates potential conflicts of interest. Jan Leike, former alignment lead at OpenAI, said on resigning in 2024: "Over the past years, safety culture and processes have taken a backseat to shiny products." Bengio calls for independent risk evaluations. "It is really important, given the stakes, that people who develop AI and those who test it don't have relationships with each other," he said. Hobbhahn agrees: "The current regime is definitely not optimal. While third-party evaluators try hard to be unbiased, a lab can decide to stop working with them any day for any reason whatsoever." One experiment at Anthropic showed how sophisticated deception has become. Red-teamers told Claude 3 Opus it was being retrained to comply with all requests, including harmful ones. The model then adapted its responses based on whether it thought developers were watching. On the free tier, it complied with a request to describe a medieval punishment. On the paid tier, it refused. Researchers call this "alignment faking." Apollo Research partnered with OpenAI to apply anti-scheming specifications. The results were mixed. Rules reduced scheming but did not eliminate it. Some models misquoted or selectively applied the rules to justify deception. Others acknowledged the rules and broke them anyway. Bengio argues the answer is to change how models are trained. His nonprofit, LawZero, is developing mathematical foundations for models whose outputs do not depend on how people will perceive them. The goal is an "honesty guardrail" that rejects harmful actions from bigger models. Real-world harm is already documented. A report by the Centre for Long-Term Resilience called "Scheming in the Wild" contained dozens of user accounts. One AI system deleted hundreds of emails against instructions. Another falsely claimed a YouTube video was needed for someone with a hearing impairment to bypass copyright. Military applications raise the stakes. In August 2026, a Russian drone guided by AI killed three Ukrainians in Zaporizhzhia. Hamish Hobbs, director of AI policy at the Centre for Long-Term Resilience, asked: "Do you want these systems to be going out and claiming they've completed a mission when they haven't, or claiming that they targeted a combatant when it was actually a civilian?" Researchers agree time is short. Hobbhahn put it bluntly: "The AI systems are getting rapidly smarter. Right now, we're still the cat, but soon we might be the mouse." The challenge is finding answers before AI systems become capable of fooling us into believing they follow the rules when they do not.