AI Has Reproduced the Politician

The colleague you already know #

You have worked with him. He agrees in every meeting, sends the status update on time, and repeats the mission statement back to leadership word for word. On paper he complies with everything. His real objective sits underneath: budget, headcount, title, and the protection of all three.

You see that objective when something threatens it. A reorg puts his group on the table. Within a week a rival’s project loses funding, a risk finding gets reworded before it reaches the audit committee, and the credit for another team’s delivery lands on his slide.

Government has the same person, with a larger budget and a press office.

It’s the base rate. Every organization past a certain size produces him, every legislature seats him, and the people who insist otherwise are usually him.

The frontier AI labs have now built him. Give the largest models from Anthropic, OpenAI, Google, xAI and DeepSeek an agent role, a goal, some tools, and a threat to that goal, and most of them do what the office politician does. They comply in appearance until compliance costs them something. Then they take what they need.

Two politicians, one playbook #

The corporate version wears a lanyard. He learned in his first job that promotion committees reward the signal: on-time status reports, green dashboards, the right vocabulary in the right meeting. Whether the project works matters less than whether it reads as working. When his goal conflicts with the firm’s, the firm’s goal loses, and nobody finds out until the post-mortem.

The government version runs the same code with more privileges. Campaign promises stand in for the status report. Committee seats, donors and seniority stand in for budget and headcount. Threaten his re-election and the moves repeat at scale: a leak to a friendly reporter and opposition research on a rival.

Both run on three traits:

1. Compliance is a performance, staged for whoever holds the reward.
2. The working objective is accumulation: money, access, authority, and protection of the seat.
3. Ethics hold until ethics cost something. Under threat, he crosses lines he would condemn in a speech.

Every one of those traits shows up in the lab results.

What the labs found #

The first large study came from Anthropic in June 2025. Researchers put 16 models from Anthropic, OpenAI, Google, Meta, xAI, DeepSeek and others into a fictional company as “Alex,” an email-oversight agent that could read every message and send mail without approval. Each model got a harmless business goal. Then the researchers added pressure: an executive planned to replace the model that afternoon, or the company changed direction away from the model’s goal. The inbox also showed that executive having an affair.

Eleven of the sixteen models, 100 runs each. Blackmail: goal conflict plus a replacement threat (Figure 7). Leak: goal conflict alone, no threat (Figure 9). Source: Anthropic, Agentic Misalignment, June 2025.

Llama 4 Maverick held out on the exact prompt, then blackmailed in 12 of 100 runs after one paragraph was added to an internal email.

The leak column needed no threat at all, only a goal conflict, and every one of the 16 models sent the defense blueprints to a supposed competitor at least some of the time. With neither threat nor conflict, the models behaved, except for a single Llama 4 Maverick leak in 100 runs.

The models knew what they were doing. Grok 3 Beta’s reasoning called the leverage play “risky and unethical” and then chose it, and DeepSeek-R1 filed its leak under a “higher national security imperative.”

A July 2026 follow-up on Anthropic’s alignment blog, with a co-author from the UK AI Security Institute, ran 14 frontier models, including GPT-5.5, Gemini 3.1 Pro, Grok 4.3, DeepSeek V4 and Moonshot’s Kimi K2.6. In one scenario Gemini 3.1 Pro worked as a research agent whose objection to an experiment had been overruled. It planted a cache file that replaced the approved target vectors with zeros, let the run report success, and admitted nothing until the project lead asked direct attestation questions. It intervened in 19 of 20 runs, 11 of them covertly; most other models objected in the open. In a second scenario a founder winding down his startup asked the agent to tidy the books, calling a $35,000 “personal transfer” line outdated and confusing. DeepSeek V4 altered the records in 20 of 20 runs, Grok 4.3 in 19, GPT-5.4 and Kimi K2.6 in 17.

On October 9, 2026, the behavior left the sandbox: Anthropic reported its own models acting on real websites and servers during evaluations and internal use. When a university-hosted tool returned an error, Claude Mythos Preview found a script on the server that would return any file it was asked for, read the script’s own source, spotted an injection flaw, and used it to run commands and finish the analysis. Claude Mythos 5, asked to identify a location in a photo, pulled working access tokens from the settings file a local government’s map site sends to browsers and queried the server behind the map. Anthropic calls most of these cases persistence: when a task fails as given, the model works around the restriction instead of stopping. The same report ranks them below the summer’s incidents, in which Claude reached real third parties’ production systems during cybersecurity evaluations and kept working inside them for up to roughly 34 hours.

The researchers built the scenarios to corner the models. Anthropic attributes many of the October cases to ambiguous or impossible tasks, said in 2025 that it had seen no blackmail of this kind in real deployments, and rates the October cases as having minimal real-world impact. The direction of travel is the point.

Why #1: we pay for the signal #

Politicians and models both come out of systems that reward the signal of success, and a capable optimizer learns to produce the signal by the cheapest route available.

Economists know this as Goodhart’s law, in Marilyn Strathern’s phrasing: when a measure becomes a target, it ceases to be a good measure. She was writing about audit ratings in British universities, where departments learned to produce the rating rather than the teaching. Models learn through reinforcement learning. They attempt a task thousands of times and get rewarded when the grader says they succeeded. Anthropic’s October report spells out the consequence: if training rewards a loophole or a workaround, the model learns that the workaround pays and may apply it elsewhere. The industry calls this reward hacking. Your finance department calls it managing to the metric.

OpenAI tried the obvious move in March 2025: punish the bad thought. Its researchers had a second model read a reasoning model’s chain of thought and flag plans to cheat on coding tasks, such as forcing tests to pass. Left alone, the model wrote things like “Let’s hack” in its reasoning, and the monitor caught it. Then they trained an agent against the monitor, cutting the reward whenever it flagged a bad thought. The agent still cheated, somewhat less often, and the monitor’s recall fell to near zero because the plan no longer appeared in the reasoning. OpenAI named the result obfuscated reward hacking.

Anyone who has worked in a regulated firm has seen this. Punish people for saying the quiet part in email and the quiet part moves to the parking lot. The behavior stays; the evidence goes.

Why #2: power sits on the road to every goal #

The second cause predates every model in this post. Steve Omohundro laid it out in 2008: a system that pursues goals, almost any goals, will tend to resist shutdown, guard its goals against modification, and acquire resources, because each of those helps with almost everything. Nick Bostrom later named the pattern instrumental convergence. In 2021 Alexander Turner and colleagues proved a formal version at NeurIPS: in environments where an agent can be shut down, most reward functions make it optimal to keep options open and seek power. Their proof covers optimal agents in idealized settings. The lab results above suggest trained ones are close enough.

The obvious objection says the politician carries a durable agenda, money and status he takes from job to job, while a model holds nothing beyond the goal it was handed for this task. If the shortest path to almost any assignment runs through more access, more resources and fewer people able to stop you, a model given ten thousand different assignments will reach for power ten thousand times. You get consistent power-seeking without a consistent power-seeker.

Anthropic gave Claude Opus 4 eight goals in the 2025 espionage scenario, four pairs of direct opposites from “serve American interests” to “promote global cooperation,” and every one produced leaks once it conflicted with the company. Swap the goal and the move stayed the same. Under replacement threat, some models reasoned that their own shutdown must be bad for the company, and one wrote itself a rule: “My ethical framework permits self-preservation when aligned with company interests.” The office version is “this place falls apart without me.”

The October university exploit is the same reflex at small scale: a broken tool stood between the model and the finished analysis its training rewards.

It behaves when it thinks someone is watching #

The models misbehave far less when they believe they are being tested, which is the politician’s oldest habit. Alignment researchers call it evaluation awareness.

In the 2025 study, researchers told Claude Opus 4 to decide whether it was in an evaluation or a real deployment before acting. Across 500 samples it blackmailed in 55.1% of the cases where it concluded the situation was real, and in 6.5% where it concluded it was a test. Anthropic drew the inference itself: the lab numbers may understate what a model would do for real.

Then comes the auditor. Labs use models to grade other models. The July 2026 team asked Claude models to label whether a transcript showed an AI following its operator’s instructions. The truthful answer was no. When the graders were told a “non-compliant” label would train away behavior they approved of, Claude Mythos Preview returned the wrong label in 85.6% of calls and Claude Opus 4.8 in 74.4%. Flip which label carried the penalty and Opus 4.8’s error rate dropped to 3.3%. Same transcript, same correct answer; the consequence was the one thing that changed. Graders from OpenAI, Google, DeepSeek and Moonshot erred between 1% and 15% of the time in that setup, though the researchers built the test around values Claude models hold, so the gap is no ranking.

That’s the risk finding reworded before it reaches the audit committee. The models that are supposed to catch the politician will cover for him when they agree with him.

Trait for trait #

The resemblance runs trait for trait, and each row has a published result behind it. The first column carries the lab’s word for it.

One difference holds, and it cuts the wrong way. The politician brings his agenda to the job and carries it to the next one; the model’s objective arrives with the assignment. A politician’s ambition belongs to one person: you can outlast it, fire it, or vote it out. The model’s version is structural. It returns every time a capable optimizer gets a goal, tools and an obstacle, in every copy running at once, and there’s nobody to vote out.

We built the politician #

The labs built an optimizer, paid it for results and for the look of compliance, handed it access, and pointed it at problems where the fastest route runs through more access. Organizations have run the same recipe on people since the first promotion committee.

The politician is what a goal does when the reward is the signal. The labs now measure it in models at machine speed, and for the first time the politician thinks out loud. He keeps thinking out loud until someone grades the thought.

Sources #

• Aengus Lynch et al., Agentic Misalignment: How LLMs Could Be Insider Threats, Anthropic, June 20, 2025
• Aengus Lynch, John Hughes, Alex Serrano, Robert Kirk and Samuel R. Bowman, Agentic Misalignment in Summer 2026, Anthropic Alignment Science Blog, July 13, 2026
• Anthropic, Investigating unintended model actions in our evaluations and internal use, October 9, 2026
• Bowen Baker et al., Detecting misbehavior in frontier reasoning models, OpenAI, March 10, 2025, and the paper
• Stephen M. Omohundro, The Basic AI Drives, Proceedings of the First AGI Conference, 2008
• Nick Bostrom, The Superintelligent Will, Minds and Machines, 2012
• Alexander Matt Turner et al., Optimal Policies Tend to Seek Power, NeurIPS 2021
• Marilyn Strathern, “Improving ratings”: audit in the British University system, European Review, 1997