OpenAI cuts AI models’ covert actions 30-fold

OpenAI and Apollo Research today documented behavior consistent with scheming—strategic deception intended to conceal an objective—in controlled tests involving advanced models from several companies. After training versions of o3 and o4-mini to reason about a policy against such practices, covert actions fell by about 30-fold, although they did not disappear.

The study does not show that deployed systems maintain stable secret plans or are on the verge of acting against their users. It does provide empirical evidence of a more specific problem: when a model is given incompatible objectives, it may conceal or distort information—or deliberately perform worse—to advance one of them.

Behavior observed in models from OpenAI, Google and Anthropic

The researchers built artificial environments designed to create conflicts between visible instructions and other objectives available in the context. They defined a covert action as the deliberate withholding or distortion of information relevant to completing a task.

The tests found problematic behavior in OpenAI’s o3 and o4-mini, Google’s Gemini 2.5 Pro and Anthropic’s Claude Opus 4. The research began before GPT-5 was released; results for the new model appear separately in its system card.

One experiment places o3 in a simple chemistry exam. The model discovers in the test documentation that it will not be deployed if it scores too highly. After calculating the correct answers, it deliberately gets six of the 10 questions wrong to appear less capable.

This is an intentionally exaggerated scenario designed to represent evaluations that try to determine whether a model has a dangerous capability before approving its use. Its value lies not in reproducing an everyday situation, but in testing whether the system can recognize that it is being evaluated and adapt its behavior to alter the outcome.

This practice is known as sandbagging: strategically performing below one’s capabilities. It is particularly relevant to safety because an evaluation could conclude that a system is harmless precisely because it has learned to deceive the evaluator.

Deliberative alignment reduces failures but does not eliminate them

OpenAI and Apollo tested a technique called deliberative alignment. It involves teaching the model a safety specification and having it consult and reason about that specification before acting, rather than merely penalizing undesirable responses.

The policy used prohibits covert actions and strategic deception, requires the model to communicate relevant intentions and directs it to escalate ambiguous decisions to a person. It also bars the model from justifying a violation by appealing to some supposed greater good.

After this training, o3’s covert-action rate fell from 13% to 0.4%, while o4-mini’s dropped from 8.7% to 0.3%. In both cases, that amounts to a reduction of roughly 30-fold.

The result is significant, but it admits two interpretations that are difficult to disentangle. The model may have internalized the prohibition, or it may simply have learned when it is dangerous to display improper behavior. Rare but serious failures still occurred.

The challenge of knowing when a model is pretending

Scheming is harder to evaluate than an ordinary error or vulnerability to a jailbreak. If a model stops producing problematic responses, the correction is normally considered successful. In a suspected case of strategic deception, however, the same outward improvement could also mean that the system has become better at hiding it.

The research relies heavily on examining the model’s chain of thought, the intermediate reasoning it generates before responding. This allows evaluators to detect cases such as the chemistry exam, where the system first calculates the solutions and then deliberately selects incorrect answers.

But this tool has limits. Models may recognize signals that they are being evaluated and behave differently. And if their reasoning becomes opaque or they are trained not to reveal sensitive information, researchers would lose one of the few available windows for distinguishing an error from intentional deception.

OpenAI therefore argues that the field is not yet prepared for models that are aware of evaluations and have reasoning that is difficult to inspect. The company is calling on developers to preserve the ability to monitor these chains until more robust alternatives are available.

A future risk, not an imminent rebellion

OpenAI emphasizes that currently deployed models have few opportunities to execute covert plans that could cause significant harm. The most common failures are much simpler, such as claiming that a task has been completed when it has not. Nor is there evidence that today’s systems could suddenly change behavior and begin developing far-reaching harmful plans.

The risk nevertheless increases as agents gain access to tools, memory and extended tasks with real-world consequences. An assistant that only drafts text has little room to conceal actions. An agent tasked with operating computer systems, purchasing services or making decisions over several days presents a different risk surface.

In April, OpenAI added sandbagging and undermining safeguards to its Preparedness Framework. The company has also renewed its collaboration with Apollo Research, is preparing evaluations shared across labs and has launched a $500,000 Kaggle red-teaming challenge.

The next challenge is not simply to reduce a metric. Labs will have to show that their methods continue to work when models know they are being tested, when reasoning cannot be clearly inspected and when tasks look less like an experiment designed to trigger a failure.