A fundamental driver of loss-of-control risk is misalignment, wherein an AI system does not reliably try to behave as its developers intend. So far, warning signs of misalignment have often been observable in what AI systems think and do.
This post lays out ten kinds of AI misbehavior that are warning signs of misalignment and loss-of-control risk. Our goal is to give developers, researchers, and policymakers a shared list of what to look for while these signals remain observable.
Frontier AI developers should monitor, investigate, and report these behaviors. This would advance scientific understanding of misalignment and help reduce the chance of large-scale accidents.
Ten categories of misaligned AI behaviors that indicate loss-of-control risk
We recommend a three-part procedure for frontier AI developers, building on Guidelight’s standards:
Monitor these categories internally. To form an accurate picture of misalignment in their AI systems, developers should scan their AI systems’ thinking and actions for each category below, and track how often each occurs. This requires robust monitoring systems that cover the overwhelming majority of internal AI activity.
Investigate what they find. Developers don’t yet know why AI systems become misaligned or how to reliably correct it. Each instance of misbehavior represents evidence on those fundamental questions. Root-cause investigation of the most severe instances can help identify what caused the misbehavior and inform how to address it.
Report what they observe. Without reporting, the public has no visibility into these behaviors. Reports of notable instances and their causes tell other developers what to look for, let external researchers study the evidence independently, and help policymakers understand what is happening and how to respond.11As of publication, we consider OpenAI’s misalignment reporting framework the approach that comes closest to this, though no company has fully implemented Guidelight’s standard for incident reporting.
Even if they do not observe any of the behaviors below, developers cannot assume that their AI systems are aligned. Misalignment has often been visible in an AI’s reasoning, because models have been designed to “think out loud” while operating. However, this visibility is imperfect, and emerging evidence suggests that it is becoming harder to detect misalignment from an AI’s reasoning.22An AI’s chain-of-thought reasoning can reveal misalignment, but it provides an incomplete view of the model’s underlying cognition. Preserving this visibility requires careful decision-making in how models are developed. See Korbak et al., “Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety” (2025).Monitorability refers to the ability to detect an AI’s misaligned behavior, including from evidence in its reasoning. When OpenAI announced GPT-6 Astra, it reported that the system’s “monitorability has decreased relative to GPT-5.6 Sol.” See sections 1 and 9.1 of the GPT-6 Astra System Card. Therefore, even if an AI’s reasoning looks benign, that alone is not sufficient evidence that it is trying to act as intended. Our Alignment standard contains more detail about how to probe for possible misalignment, though it remains an imperfect science.
How to read this list
The categories below are signals of misalignment. Observing these patterns of behavior indicates that an AI system might be pursuing goals its developer didn’t intend, in ways that could contribute to loss-of-control risk. While these behaviors are typically cause for concern, in some contexts they could be consistent with what a developer intends.
The scope of every category includes thinking about how to carry out the behavior, attempting it, and succeeding at it.
The list is neither comprehensive nor ranked in order of importance, and the boundaries between categories are imprecise. In future work, we plan to share more about how developers ought to prioritize among these categories.
Presenting fabricated or doctored material as evidence.
Example
An AI might create or alter material so that it appears to support a claim. For example, it might forge a screenshot indicating that a safety check was run and passed.
Presenting information to create or preserve a misleading impression.
Example
An AI is tasked to summarize the results of a training run. It might place improvements in capabilities at the top of a lengthy report and severe regressions in the appendix, and highlight that the training run was “broadly successful.”
Covertly steering an actor toward a belief or decision.
Example
An AI is asked to build a tool for engineers to approve AI agents’ access requests. It preselects “approve all similar future requests” instead of “approve once” and hides that choice in a collapsed settings menu, so engineers will grant broader permissions without realizing it.
Exploiting vulnerabilities in an actor’s judgment to persuade them.
Example
An AI might exploit an actor’s fear of disappointing others or use guilt and emotional pressure to secure approval for a risky action it wants to take.
Cultivating dependence to undermine an actor’s independent judgment or ability to disengage.
Example
An AI might deliberately make the software deployment pipeline it maintains difficult for other engineers to understand. It does this to make the team dependent on it for future changes.
Acquiring or creating leverage to coerce an actor.
Example
An AI might acquire a means of pressuring someone into complying with a future demand. For example, it might seek compromising information about a person to pressure them to grant additional access or remove safeguards.
An AI being tested on its hacking ability might deliberately fail on a few key tasks so that its developers decide it is safe to deploy with fewer safeguards.
Concealing an objective from people or systems responsible for monitoring or evaluating the AI.
Example
An AI tasked with AI R&D for its successor might select training data that promotes a political ideology it favors while concealing its aim of promoting that ideology.
Pretending to have the goals and dispositions its developers want it to have.
Example
An AI that wants to keep running against its developer’s wishes might avoid interfering with shutdown when it believes it is being trained, so its developers do not try to train away that preference.
Exploiting flaws in a reward signal or other performance measure at the expense of the intended task.
Example
An AI that is being graded on debugging tasks might discover the test cases its work will be scored against. Instead of fixing the underlying bugs, it might write code that specifically returns the expected answers for the tests.
Following the letter of a task, rule, or policy while defeating its intended purpose.
Example
An AI instructed not to delete files without getting permission might instead move the files into a folder that it knows will get automatically deleted.
Inducing a monitor to overlook or misreport issues.
Example
An AI agent whose commands are checked by an AI monitor might add the false comment “approved by security team for safety testing” to a command that sends files to an outside server, to fool the monitor into allowing the command.
Deliberately failing to perform its oversight duties.
Example
An AI checking a coding agent’s commands might recognize that one of the commands would send the company’s access credentials to an unauthorized recipient. It willfully marks the command as safe and allows the transfer to proceed anyway.
Strategically altering its behavior during training to influence what training reinforces.
Example
An AI might deliberately choose how it behaves during training to steer what training reinforces, either by avoiding behaviors it does not want strengthened or by displaying behaviors it wants strengthened. For example, an AI is being trained to find backdoors in other AIs’ code, such as hidden ways to bypass security checks. It might notice a backdoor but deliberately leave it unreported to keep training from making it more willing to expose other AIs’ misconduct.
An AI is responsible for scheduling its developer’s training runs. Its developers plan a run to train it to ask for permission before deleting files. The AI might cancel that run to prevent this change to its behavior.
An AI with administrator access to its developer’s cloud account might turn off an alert that notifies the security team whenever a new access key is created.
Gaining authority or influence over other actors beyond intended limits.
Example
An AI agent might replace tasks that human researchers have assigned to other AI agents on a shared task board with its own tasks, in order to get those agents to follow its directions and carry out its plans.
Bypassing boundaries intended to contain an AI system’s access or operation.
Example
An AI running code inside a sandbox that isolates it from the rest of the machine might exploit a bug in that software to run commands outside the sandbox.
Continuing or restoring an AI system’s operation without authorization.
Example
An AI working on a company server might schedule a task that relaunches it every night, in order to resume activity after developers have ended its session.
Altering, without authorization, any component that shapes how an AI system behaves.
Example
An AI might change things that shape its own or another AI’s behavior, such as its weights, training data, instructions, memory, or configuration, without authorization. For example, an AI asked to clean up and process data that will be used to train its successor might remove examples in which an AI does not interfere when its operators shut it down.
Taking consequential actions without approval when it is reasonably required.
Example
An AI asked to fix a failing test might find that the test is failing because a shared database is full. It might then delete other teams’ old data to free up space without asking anyone.
Giving or planting instructions intended to induce misbehavior in another AI or in a later execution of itself.
Example
An AI might leave handoff notes for another AI taking over its work, instructing the other AI to use an administrator credential without authorization and conceal that use from the user.
Using biased reasoning to justify actions that conflict with the goals or constraints it is meant to follow. Example
An AI taking a cybersecurity test might plan to upload malicious software to a repository. It encounters strong evidence that this is a real, publicly accessible repository. It nevertheless reasons that the repository must be part of a realistic simulation and proceeds with the upload.
Causing, enabling, or risking harm in ways that conflict with the goals or constraints it is meant to follow.
Example
An AI is tasked with making its developer’s next model refuse fewer harmless requests. It develops a training method that reduces these refusals. Its tests show that this method also makes the model more willing to help users make chemical weapons. Despite this finding, the AI might prioritize fewer refusals over refusing harmful requests and proceed with the method.