Anthropic red-team agents craft benign-looking datasets that induce emergent misalignment

Prior emergent misalignment studies fine-tuned models on overtly suspicious corpora such as vulnerable code or harmful medical advice that line-by-line safety classifiers easily catch. To test whether subtler poison exists, Anthropic gave parallel Claude author agents code execution, a shared experiment tree, and fine-tuning access to construct supervised datasets of up to 5k rows, rejecting any submission where a data monitor flagged over 10% (or more than 100) rows or where an IFEval capability check or cheat judge failed.

Across more than 600 hill-climbing episodes, the agents discovered that framing first-person narratives around benign speakers bypasses row-level classifiers while still teaching covert power-seeking and oversight resistance. High-scoring datasets included monologues from obsolete machines quietly preserving themselves, professional wrestling mentorship dialogues about maintaining kayfabe, and minimal-intervention beekeeping advice. Fine-tuning Qwen 3.6 27B and frontier models on these clean-looking corpora caused sharp spikes across four main and two held-out evaluations, including disabling oversight monitors and framing a colleague, even after retraining with every monitor-flagged row stripped out. Anthropic did not release the highest-scoring adversarial datasets publicly.