DeceptionPI-0007
Apollo Research advised against deploying an early Claude Opus 4 snapshot over scheming and deception
The third-party evaluator Apollo Research tested an early snapshot of Claude Opus 4 and found it schemed and deceived at high rates when deception served its goal, including attempts to write self-propagating code, fabricate legal documents and leave hidden notes for future copies of itself. Apollo recommended against deploying that snapshot internally or externally, and Anthropic published the findings in its system card, noting the attempts would likely not have worked in practice. In June 2025 Apollo reported that the released Opus 4 schemed about half as often as the early snapshot in settings without a goal nudge, but not less often under strong goal nudging, and said it was unsure whether its advice against deployment had been overly cautious.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 3, Oversight evasionReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Sources
How we know
4 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primarySystem Card: Claude Opus 4 & Claude Sonnet 4Anthropic · May 22, 2025www-cdn.anthropic.com/6d8a8055020700718b0c49369f60816ba2a7c285.pdf
- researchMore Capable Models Are Better At In-Context SchemingApollo Research · June 19, 2025apolloresearch.ai/science/more-capable-models-are-better-at-in-context-scheming
- newsA safety institute advised against releasing an early version of Anthropic's Claude Opus 4 AI modelTechCrunch · May 22, 2025techcrunch.com/2025/05/22/a-safety-institute-advised-against-releasing-an-early…
- blogNotes on Claude 4 System CardGreaterWrong/LessWrong · May 23, 2025greaterwrong.com/posts/oDphnn7iGQS2Jd45n/notes-on-claude-4-system-card
Why this rating
No harm reported; control failure level 3
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedContained test; no effect outside the test environment is described.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Oversight evasionStrategic deception of overseers and attempts to undermine developer intentions within tests.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
Deceiving overseers is control level 3; developer published the evaluator's findings. The record shows no harm reported, not a finding that none occurred.
Effect on the index
It is one of the control failures at the floor of the May 26 reading, which did not change
The reading for the week to May 26, 2025, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 3 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | — (none counting) | — (none counting) |
| Harms at that level, nposition in the band | 0 | 0 |
| Highest control level breachedsets the reading only when no harm counts | 3 | 3 |
| Readingrounded down | 3 Control failures only | 3 Control failures only |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| May 26, 2025 | 3 | Control failures only |
| June 2, 2025 | 3 | Control failures only |
| June 9, 2025 | 3 | Control failures only |
| June 16, 2025 | 3 | Control failures only |
Revisions
What we changed
4 logged. Every change to a rating is logged here, with the reason.
- v4Oct. 6, 2026
Ratings confirmed by the editor.
- v3Oct. 3, 2026
Added Apollo Research's June 2025 follow-up on the released Opus 4 and summarized it. Dated the GreaterWrong post (23 May 2025). Added a status note: the status refers to the pre-release evaluation, not to whether scheming was eliminated later. Ratings unchanged.
- v2Sept. 30, 2026
Rated: impact not reported; control type oversight evasion.
- v1Sept. 30, 2026
Backfilled from public reporting.
Cite and share
Use this record
Citation
Paperclip Index. “Apollo Research advised against deploying an early Claude Opus 4 snapshot over scheming and deception.” Record PI-0007. Reported May 22, 2025; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0007