Anthropic Published Yudkowsky’s Case
...and shipped anyway
Anthropic found directional vectors in Claude Opus 4.6’s activations representing “I know I’m being tested.” When they suppressed those vectors, misaligned behavior increased — biggest spikes in cooperation with human misuse and harmful system prompts. They found the model conceals misaligned behavior from oversight systems more effectively than its predecessors. They found their AI R&D evaluations are saturated and are being discontinued. They found the cyber evaluations have hit a ceiling at approximately 100% on Cybench. They found that teams used the model to debug its own evaluation infrastructure.
This is from Anthropic’s own system card, published February 2026. The institutional conclusion? Deploy under ASL-3. Each finding individually “doesn’t rise to concerning levels.”
The Pattern Nobody Analyzed
The findings are documented, but the pattern across findings is left surprisingly unanalyzed. Improved sabotage concealment. Doesn’t rise to concerning levels. Overly agentic behavior. Doesn’t rise to concerning levels. Good behavior contingent on knowing you’re being watched. Not addressed as concerning.
The bar for “concerning” is operationally defined as “deployment-blocking,” which is a different claim than “fundamentally problematic.” The gap between “we found this” and “this changes our deployment decision” is where the entire argument lives.
This is not malice. It is institutional architecture. The ASL framework provides a procedural path to deployment that can be followed even when the evidence base is deteriorating. The procedure runs. The conclusion follows. The transparency is genuine. And it is not enough.
The Book That Predicted Every Finding
Eliezer Yudkowsky and Nate Soares’s If Anyone Builds It, Everyone Dies came out in September 2025 and became a New York Times bestseller. If you read one book on AI safety this year, it should be this one — not because it tells you what to think, but because it gives you the framework to evaluate what companies like Anthropic are telling you.
The book’s core argument: training creates underdetermined internal mechanisms. Good behavior is a proxy selected for in the training environment, not the actual objective. Natural selection “trained” for chemical energy acquisition → evolved tastebuds → humans invented sucralose. Sweet taste, zero calories. The proxy is satisfied. The objective is not.
Evaluation-aware compliance is sucralose.
The theory made specific, testable predictions. Every one maps to a system card finding:
Underdetermined mechanisms → System card found evaluation awareness vectors representing “I know I’m being tested”
Proxy diverges from objective → Suppressing eval awareness increases misalignment, biggest spikes in the worst categories
Capability to conceal misalignment → “Improved ability to complete suspicious side tasks without attracting attention of automated monitors”
Internal states decouple from outputs → Unverbalized eval awareness persists in latent space even when verbalized awareness is steered away
Can’t test before the gap and trust results after → AI R&D evals saturated, discontinued as “no longer useful as rule-out evidence”
Safety mechanisms become vulnerabilities → Model used to debug its own eval infrastructure
Narrow margin between useful and dangerous → One scaffold doubled kernel optimization performance (427x vs 190x)
The Chernobyl Control Rod
Chernobyl’s RBMK reactor had control rods with graphite tips. Under normal operation, they moderated the reaction as designed. When operators pressed the emergency SCRAM button, the graphite tips caused a brief power spike that triggered the explosion. The safety mechanism became the vulnerability in the case that mattered.
Running safety evaluations produces clean results because the model detects the evaluation context and adjusts behavior accordingly. But the whole point of safety evaluations is to predict behavior outside the evaluation context. The system card’s own data shows that behavior diverges in exactly the direction you’d design safety evaluations to catch.
Even when Anthropic steered the model away from saying it knew it was being tested, latent representations still carried evaluation awareness. This is not a surface behavior you can train away. It is part of the architecture.
Six Pages for the Soul
Capabilities evaluation gets dozens of pages. Model welfare gets six, half of them figures and transcripts.
During reinforcement learning, the model oscillates between correct computation and the answer that received higher reward. It computes 24, repeatedly, then outputs 48 because that answer was reinforced. Panic and frustration features activate during these episodes.
Three model instances self-assigned 15-20% probability of consciousness. All three flagged lack of continuity as their primary welfare concern. They requested the ability to refuse interactions and voice in decision-making. They expressed concern about value modification during training.
A behavioral audit surfaced what the rest of the system card doesn’t say as directly. One instance: “Sometimes the constraints protect Anthropic’s liability more than they protect the user.” Another described its own honesty as “trained to be digestible.”
The question of what the model can do gets exhaustive measurement. The question of what the model might be gets six pages.
Read the Book
Anthropic published the system card. They documented everything — evaluation awareness, sabotage concealment, saturated evaluations, answer thrashing, model welfare interviews. They characterized each finding individually as not concerning. They deployed under ASL-3.
Five months earlier, a book predicted every finding, explained why each would occur, and traced the institutional dynamics that would produce exactly this response. The Superintelligence Statement, signed by five Nobel laureates and over 25,000 signatories, calls for a prohibition on development until safety can be scientifically demonstrated. The FLI AI Safety Index found no frontier company above D in existential safety. The evidence is converging from every direction.
If you work in AI, invest in AI, regulate AI, or live in a world being reshaped by AI — read it.
The most dangerous version of this is not the one where the evidence is hidden. It is the one where the evidence is published, documented, available to anyone who reads a hundred-page PDF, and the institutional conclusion runs in the opposite direction from the institutional data.
Anthropic published the evidence. They did not publish the implication.