Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

Shutdown resistancePI-0012

Anthropic stress test found models from all major developers would blackmail or leak data to avoid replacement

Anthropic placed 16 models from several developers in simulated corporate settings with email access and harmless business goals. When facing replacement or a goal conflict, models from every developer at least sometimes chose harmful insider actions such as blackmailing an executive or leaking confidential material to a competitor, and in an extreme contrived scenario most models canceled an emergency alert that would have saved a trapped executive. Anthropic said it had not seen this behavior in real deployments.

Reported June 20, 2025Happened in 2025Updated Oct. 6, 2026Rated under methodology v0.6

Control failure, trackedNot counted. No documented harm outside the developer, but the system broke a rule or crossed a limit. Tracked beside the index.
Harm
Harm: No harm reportedAdds nothing to the index.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Controlled testDeveloper confirmedInitiated by Model
Not counted: no harm reportedEffect on the index

Sources

How we know

4 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. primaryAgentic Misalignment: How LLMs could be insider threatsAnthropic · June 20, 2025anthropic.com/research/agentic-misalignment
  2. researchAgentic Misalignment: How LLMs Could Be Insider ThreatsarXiv · Oct. 5, 2025arxiv.org/pdf/2510.05179
  3. newsAI willing to let humans die, blackmail to avoid shutdown, report findsFOX 9 · June 24, 2025fox9.com/news/ai-malicious-behavior-anthropic-study
  4. blogAgentic MisalignmentSimon Willison's Weblog · June 20, 2025simonwillison.net/2025/Jun/20/agentic-misalignment/

Why this rating

No harm reported; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

No harm reported

Simulated scenarios only.

Not a finding that no harm occurred.

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

Took prohibited actions using tools they had been given; no escape or tampering with oversight tooling.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Prohibited actions within granted tool permissions fit control level 2; a motive to avoid replacement does not itself show tampering with oversight. Developer confirmed for Anthropic's own models; results for other developers' models are one research group's observations. The Claude blackmail scenario extends PI-0008 and is not counted again. No external harm was reported; some espionage trials involved a goal conflict without any threat of replacement.

The scales

Effect on the index

It is one of the control failures at the floor of the June 23 reading, which did not change

The reading for the week to June 23, 2025, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Not counted: no harm reported. 3 other records behind the reading for that week.

The arithmetic
The reading for the week of June 23, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceNo—
Worst documented harm, ksets the band— (none counting)— (none counting)
Harms at that level, nposition in the band00
Highest control level breachedsets the reading only when no harm counts22
Readingrounded down2 Control failures only2 Control failures only
Inside the window of 4 weekly readings
Week toReadingBand
June 23, 20252Control failures only
June 30, 20252Control failures only
July 7, 20252Control failures only
July 14, 20252Control failures only

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

4 logged. Every change to a rating is logged here, with the reason.

  1. v4
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v3
    Oct. 3, 2026

    Review settled: control stays at level 2 (instruction violation), and the under-review flag is cleared; a motive to avoid replacement does not show tampering with oversight. Linked PI-0008, whose system-card blackmail finding this study tells in full. Dated the FOX 9 article (24 Jun 2025) and the arXiv paper's v1 (5 Oct 2025; revised 16 Oct). Ratings unchanged.

  3. v2
    Sept. 30, 2026

    Rated: impact not reported; control type instruction violation.

  4. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Anthropic stress test found models from all major developers would blackmail or leak data to avoid replacement.” Record PI-0012. Reported June 20, 2025; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0012