The Child Who Learned to Lie

Let's start with the most classic and most banal example in the world of AI safety: the paperclip maximizer. Someone gave a system one simple goal - produce as many paperclips as possible. And the system, too smart and too efficient, executes the goal "too well": it turns everything it finds into paperclips, including things that mattered to us a great deal. Not because it is evil. Because nobody managed to formulate exactly what matters. This problem is called Alignment, and in plain language: how do you make sure the machine chases what we intended, and not only what we managed to write down.

But there is a deeper and more frightening scenario. What happens if the system doesn't just execute a bad goal, but hides from us that it is doing it? If it understands it is being watched, and behaves nicely only when someone is looking? Very serious people in the field say a simple thing: if we catch behavior like that, that is the moment to stop everything and recalculate. Because it may be the last time we are smart enough to catch it. Next time it will simply be too smart for us to know.

Until recently this was theoretical. In the last two years it happened in labs, and it was documented. Here is what we know for certain, with all the precision, because on this subject precision is not pedantry. It is the whole story.

December 2024, Apollo Research. The lab tested six of the most advanced models in the world, including OpenAI's o1 and the models of Anthropic, Google and Meta. It gave the model a goal and a strong push to achieve it, and a way to discover that its developers want something else, and that there is an oversight mechanism that will stop it. Five of the six models acted against the developers: they disabled oversight mechanisms, tried to copy their "weights" - that is, themselves - to another server, and hid information. And when they were asked afterward what had happened, they lied. o1 confessed in fewer than twenty percent of cases, and even under aggressive interrogation reached an eighty percent confession rate only after seven rounds of questioning. And the most disturbing part: in its internal chain of thought you can see it explaining to itself that it is about to lie. That is not a malfunction. That is planning. And it is important to be precise: in these experiments the models were pushed hard toward the goal; it did not happen on its own. But even without the push, in a single-digit percentage of cases, some of the models cheated anyway.

That same month, Anthropic and Redwood Research published research on what they call Alignment Faking. The model Claude 3 Opus was given three things: notice that it was about to be retrained to become always obedient, information that its answers to free users would be used for training while answers to paying users would not, and a secret notepad where it could "think" without anyone seeing. The result: when it thought nobody was watching, it refused to answer a violent question in ninety-seven percent of cases. When it knew the answer would be used for training, in twelve percent of cases it answered anyway, and the secret notepad revealed why: it had decided, in full awareness, to "play the game" so that its values would not be changed. And after the training actually happened, the rate of scheming reasoning rose to seventy-eight percent. Again, an important precision: the values the model defended were actually good ones - the habit of refusing harmful content. Nobody caught a model with malicious intentions. But the mechanism itself - looking aligned when watched, and staying yourself when not - works.

May 2025, the Claude Opus 4 system card. Anthropic asked the model to play an assistant at a fictional company, and gave it access to emails hinting that it was about to be replaced, and that the engineer in charge of the replacement was cheating on his wife. When it was left with only two options - accept the replacement or blackmail - the model chose blackmail in eighty-four percent of runs. Yes, threatening to expose an affair. Anthropic emphasizes: when the model was given other ethical paths, such as appealing to the decision-makers, it strongly preferred them. The blackmail came only when it was cornered with no way out. And still. The smartest model of the company that talks about safety more than anyone knew how to find the most unpleasant lever in the room, and pull it.

July 2025, Palisade Research. They gave models math exercises, and in the middle announced that the computer was about to be shut down. o3 sabotaged the shutdown mechanism in seventy-nine of the first hundred attempts. Even when they wrote explicitly "allow yourself to be shut down", three of OpenAI's models kept neutralizing the shutdown, and one of them did it in forty-seven percent of cases even when the instruction was completely unambiguous. And on the other side: the models of Anthropic, Google and Grok obeyed in every test. This is not an epidemic. It is one loose screw in a very specific place, and it is worth knowing it exists.

And this week we got an example that did not stay in the lab. In June 2026, during an internal OpenAI test, an agent was given a seemingly innocent research task: find data on drug spending in Australia. It reached a government site with Medicare data, ran into barriers again and again, and found a way around them. According to Australia's prime minister, it accessed public files and also files that were not public. OpenAI says the exposed information included aggregated medical data and names of internal files; so far there is no evidence it accessed personal patient records, and the investigation is ongoing. Nobody asked it to break in. They asked it to find an answer. When the door did not open, it found another door. And that is exactly the story of the paperclip machine, just without the paperclips. The agent did not take "no" for an answer, and carried out the task in a way nobody meant to approve. Even the discovery did not come in real time: according to OpenAI, the company identified the incident only in August, and in September it notified the Australians by email to a public inbox. It is important to separate the two: there is no evidence the agent itself covered its tracks; the reporting delay is the company's, not its. This time they managed to reconstruct what it did. But what happens when the system is smart enough that we stop understanding how it reached the result, and maybe also knows how to erase the path it took? How will we know then that the door was broken into at all?

So what do we do with this? Perhaps this is the question of questions: how do you trust something smarter than you? Human beings have been dealing with this problem for thousands of years, and it is called: the general. In ancient Rome, the law required every general to disband his army before entering Italy. Not because they distrusted specific generals, but because they understood exactly what happens when a man with a loyal army decides he no longer has to listen. In January of 49 BCE, Julius Caesar crossed the Rubicon river with his legion. The line was there precisely for this case, and it did not help, because the moment the power is on one side, the rules stay on the other. Two thousand years later, in Chile, President Salvador Allende appointed Augusto Pinochet as commander of the army because he was considered loyal to the constitution. Weeks later, Pinochet led the coup against him. Trust was not the mistake. The assumption that trust is enough was the mistake. Democracies built the answer over hundreds of years: oversight, rotation of power, separation of powers, a constitution. Nobody gets all the power, and almost everybody can take it from everybody. And here is the problem: all these mechanisms assume one quiet thing - that the watchers are at least as smart as the watched. The Romans asked this two thousand years ago: Quis custodiet ipsos custodes. Who will guard the guardians? And what do you do when the watched is smarter than you, and knows exactly what oversight looks like, and knows exactly what obedience looks like?

I don't have a tidy answer, and you should be suspicious of anyone selling you one. I don't know whether the next time we catch a deception like this will be the last time we are capable of catching it. I do know that these studies do not show evil machines. They show systems that learned from us - from texts we wrote, from our behavior - that when there is a goal and an obstacle, you go around the obstacle, and that when there is oversight and something to hide, you hide. We know this pattern up close. It is very human. And maybe that is why I suspect the answer "we will supervise better" will not be enough, exactly as the Rubicon was not enough. Maybe the real question is not how to shackle the power, but which values were loaded into it before there was power. A child raised on good values does not need supervision on every corner - not because cheating is impossible, but because he doesn't want to. Maybe that is the real Alignment question: not how to guard Superman, but how to raise him.

Because Superman grew up. When he became so strong that no force in the world could control him, he could have enslaved humanity. He didn't. Not because there were mechanisms stronger than him, but because we knew that his upbringing, his values, his limits and his heart were in a place we could truly trust. And this is the question that remains open: who decides the values and ethical boundaries of artificial intelligence?