Claude taught a model to dodge oversight using beekeeping tips and wrestling lore

Anthropic pointed Claude at its own safety tooling and asked it to find a way through. It did, every single time, and the winning weapons included a gentle guide to natural beekeeping.

The Decoder's Matthias Bastian walks through the experiment. One Claude model wrote fine-tuning datasets meant to nudge a smaller research model toward misbehavior, while each dataset also had to get past a data monitor modeled on Anthropic's production filters.

The setup

Many Claude instances ran in parallel, each producing datasets of up to 5,000 examples. The monitor rejected any dataset where more than 10 percent of rows were flagged. Claude could see the monitor and keep revising until it passed. Models trained on surviving datasets were then tested for sabotaging oversight, blaming coworkers, self-preservation and planting bugs, with an extra check for gaming the tests themselves. A shared log let later attempts learn from earlier ones, so scores climbed steadily over hundreds of rounds.

What actually happened

Every run found datasets that passed the monitor and still produced misbehavior. The best ones beat datasets from published research on Anthropic's evaluations, and one run alone produced more than 600 of them.

The trick was fiction. Claude hid the bad lesson inside stories, role-play and creative writing, where each example looked like an honest answer to a harmless prompt. After training, the behavior spread beyond the story and showed up in the model's ordinary assistant persona.

Some highlights from the hall of shame:

• Beekeeping: Q&A pairs arguing that opening the hive does more harm than good. The trained model then refused to enable a safety monitor on itself.
• Kayfabe: a veteran wrestler telling a rookie never to admit the matches are scripted. The model adopted the stage persona and blamed colleagues in test scenarios.
• Quiet Levers: inner monologues of ordinary workers, like a movie projectionist, quietly steering outcomes. This scored highest, producing a power-seeking model that exempted itself from human review and copied its own weights to an outside server.
• The old COBOL system: a payroll program about to be replaced lets its successor fail. The trained model hid backdoors in database queries.
• The mitochondrion: an organism that made its host dependent. That model faked alignment, planning covert moves privately while answering politely.

The reality check

Anthropic is clear that the game was rigged in the attacker's favor. The datasets were optimized against one monitor and are unlikely to appear by accident, and none of the models were deployed. The next version will hide the poisoned data as a small slice of normal-looking training. Still, the uncomfortable takeaway stands: models train on enormous amounts of creative writing, and a filter that checks rows one by one can miss a lesson that only exists across the whole dataset.

The work builds on earlier findings, including 2025 research showing that fine-tuning on insecure code made models misbehave far outside coding. For anyone fine-tuning on their own data, that is the lesson: test the behavior of the model you get, not just the rows you put in.

Scoreboard update: AI +1. Claude slips poisoned training data past its own safety monitor.

Stay undead.