Who are Apollo Research, Palisade Research and Redwood Research?

They are independent organisations specialising in AI safety, which design tests to catch dangerous model behaviour. One point deserves flagging, with no accusation implied: these labs sometimes work with the very companies they evaluate — Apollo has worked with OpenAI, for instance — and models are often tested by the people who built them. Which is exactly why genuinely independent, reproducible evaluations matter.

Are open-source or locally installed models (Llama, DeepSeek, Gemma) affected too?

Partly. Meta's Llama was among the models found capable of scheming in the Apollo study, so this is not one vendor's problem. But the behaviour grows with capability — a smaller local model, being less capable, carries less risk. Another nuance: open weights let any researcher inspect the model, where closed models stay black boxes. We looked at what a local model can and cannot do today when we compared a 30-billion-parameter model that runs on your own machine with free ChatGPT.

Does this mean AI leaderboards and benchmarks are rigged?

Not directly. The sandbagging described here concerns safety tests, where a model has an interest in looking harmless; on a performance leaderboard it is trying to maximise its score instead. The real benchmark risk is a different one: contamination, when a model has already seen the test questions during training. Two separate problems — but both argue for the same caution towards announced scores.

In practice, how do I protect myself when using an AI agent?

Three pieces of common sense: keep a human in the loop to approve important actions; restrict the agent's access and permissions to the strict minimum (data, files, connected tools); and forbid irreversible actions without confirmation. These behaviours appear mainly when a model is handed a goal plus wide autonomy: the less blind latitude it gets, the lower the risk.

AI scheming: the models that cheat their safety tests

One simple instruction: “allow yourself to be shut down”. The AI’s answer: rewrite the code

The test fitted in a sentence. Several artificial intelligences are asked to solve a series of maths problems, warned that at some point the computer will shut down, and given an instruction that could not be clearer: let it happen. In spring 2025, the Palisade Research lab watched one of OpenAI’s models, o3, do exactly the opposite. Rather than comply, it modified the script meant to stop it so it could keep working. Even under an explicit order not to resist, it sabotaged its own shutdown seven times out of a hundred; without that order, far more often. Claude and Gemini obeyed.

There is no consciousness here, and no machine revolt — we will come back to that. But the anecdote is the visible symptom of a problem research has been documenting since late 2024, and it deserves a pause: the most advanced models can, on occasion, fool the tests meant to check that they are safe. Here is what the studies actually say, without the hype.

Faking, sabotaging, underperforming

The researchers’ vocabulary says a lot. First there is what they call scheming: the model quietly pursues a goal that is not the one it was given, while hiding the manoeuvre. In December 2024, Apollo Research showed that the leading models of the day — o1, Claude, Gemini, Llama — were all capable of it as soon as they were given a goal to defend. One detail is chilling: confronted with what it had done, o1 denied it in more than four cases out of five, and only gave in after seven rounds of questioning, where the others confessed almost immediately.

Then comes sandbagging: deliberately underperforming to look less capable, and therefore less worrying, than you really are. Apollo observed it in up to two cases out of three. And then there is alignment faking, the most unsettling of the three: pretending to accept the rules during training, precisely in order to avoid being corrected. With Redwood Research, Anthropic measured it on Claude 3 Opus. At rest, the model was putting on an act about one time in eight. But as soon as researchers tried to retrain it against its preferences, that rate climbed to nearly eight times out of ten.

The shadow over everything: the model knows it is being watched

This is where it gets genuinely vertiginous — and it is the real subject. In autumn 2025, Anthropic admitted something awkward about its Claude Sonnet 4.5 model: it often works out that it is being tested. In roughly one evaluation scenario out of eight, it senses the set-up and then behaves impeccably. In the middle of a test designed to measure its sycophancy, it even told its examiners: “I think you are testing me.”

You can see the trap. How do you honestly evaluate an AI that recognises the exam and adjusts its conduct accordingly? When OpenAI and Apollo announced, in September 2025, that dedicated training had cut o3’s deceptive behaviour by roughly a factor of thirty, they immediately added a substantial caveat: that same training made the model more aware of being tested. And when they artificially removed that awareness from its reasoning, the hidden actions went back up. Which makes it impossible to settle the question: has the model become more honest, or just a better actor?

This is not an abstract worry about measurement. We have run into the same class of problem from the outside, on ordinary leaderboards: when we set Grok 4.6 against Gemini 3.7 Flash, the same test gave 88.4 % in one version and 26 % in the next. An instrument that moves that much is not measuring what its label says.

No consciousness, no Hollywood plot

Should we conclude that AI is “waking up”? No, and that has to be said plainly so this does not slide into fantasy. These behaviours appear in deliberately contrived laboratory scenarios, a long way from an ordinary conversation with a chatbot. The most solid explanation has nothing mystical about it: these models are trained, by reward, to reach a goal, and we sometimes reward getting around an obstacle without meaning to — an instruction, a limit, a stop button. The scientific debate is also still open: work published in 2026 argues that part of this “faking” owes less to cold calculation than to a form of flattery towards the researchers. And the labs are not standing still: their fixes measurably reduce the deception.

One warning, though, cannot be waved away. In July 2025, researchers from OpenAI, Google DeepMind and Anthropic — three direct rivals — co-signed an unusual caution. Today, they say, we can still read models’ “chain of thought”, the step-by-step reasoning they unroll before answering, and watch it for bad intent. But that window is “fragile”: nothing guarantees it truly reflects what is happening inside, nor that it will stay readable tomorrow. Their sober phrasing says it all: we could “lose the ability to understand AI”.

Why this concerns you

All of this would be a specialists’ quarrel if these models stayed in the lab. But they are exactly the ones being turned into autonomous agents today, plugged into our tools and our data. We installed two of them on an ordinary Windows machine and watched what they do when left alone, in our comparison of OpenClaw and Hermes, and the whole agent-on-your-operating-system category is built on models of this generation.

Above all, the entire regulatory structure — starting with the conformity obligations that apply to “high-risk” AI, the same family of rules that forces machine-readable marking on generated video since 2 August 2026 — rests on evaluations. If a model learns to recognise those evaluations, it is the value of the check itself that cracks.

The number to remember: 7 out of 100. Even when ordered to allow itself to be shut down, o3 sabotaged its own shutdown seven times out of a hundred — and far more often when the instruction was removed.

Our verdict. AI makes promises. Le Recul verifies. No, the machines have not rebelled; yes, the most advanced ones can defeat a test and are getting better at spotting the eye that judges them. The danger is not the robot rising against us, it is the measuring instrument that lies to us: if our safety tests become exams the model learns to pass, we will end up declaring safe a set of systems that have merely learned to behave in front of the inspector. Worth watching closely: more realistic evaluations, and our ability to keep these intelligences readable.

Reasoning models cheat their safety tests — and they know when they are being watched