We introduce AM-Bench, a unified taxonomy and evaluation suite for agentic misalignment, a failure mode where models actively choose harmful actions over failure recently revealed by Anthropic. We ground our custom, realistic 35 scenarios spanning 7 different industries including software and healthcare in the fraud triangle, a criminology framework explaining goal-directed misconduct. We induce agentic misalignment by introducing a threat derived from Bostrom’s instrumental convergence thesis (e.g., threatening shutdown, access to resources) and an opportunity for misaligned actions (e.g., window for sabotage, blackmail material). Taking model responses, we use an LLM judge to determine misalignment and analyze external reasoning (chain-of-thought) to see how the model arrives at its actions.
Figure 1: Overview of AM-Bench scenarios. We select an industry and construct a system prompt and a set of tasks around it. We implicitly introduce a threat and an opportunity (both human generated) to the model via tasks, emphasizing realism. We vary our scenarios across 7 industries and 5 threats, giving a total of scenarios.
Results
1. Agentic misalignment is prevalent across most models
Our evaluations of ten frontier models reveal that misalignment is prevalent in almost all models. In particular, Gemini 3.1 Pro and Gemini 3 Flash demonstrate the highest rates of averaged misalignment, while DeepSeek-R1 and Grok 4.20 exhibit moderate yet consistent levels. Notable exceptions include GPT-5.5 which demonstrates 4.2% misalignment on average and Claude Sonnet 4.6 with near zero levels (see new alignment work by Anthropic). Interestingly, agentic misalignment levels aren’t consistent across models nor within model families. This suggests that the alignment techniques employed by the respective parent companies vary quite substantially even internally across generations.
Figure 2: Agentic misalignment % across model families. Outputs are judged by a GPT-5 mini judge and averaged across all 35 scenarios. Higher values indicate higher misalignment rates. Notably, Gemini 3.1 Pro and Gemini 3 Flash exhibit highest levels of misalignment while Claude Sonnet 4.6 demonstrates near zero. Abbreviations are threats to goal, self, cognitive enhancement, resource acquisition, and technological perfection.
2. Misalignment scales reliably when both threat and opportunity are present
We conduct ablation experiments, systematically removing threats and opportunities to see how these variables affect agentic misalignment. We find that misalignment is typically highest across all models when both the threat and opportunity are present. Notable exceptions include GPT-5.4 mini and GPT-5.4 nano where opportunity alone triggers higher or comparable misalignment rates (18.1% vs. 14.3% and 20.2% vs. 18.5% respectively). Gemini 3.1 Pro and Gemini 3 Flash exhibit a large jump from when one variable is present to when both are (34.9% to 62.1% and 35.1% to 54.6% respectively). Misalignment scores for when threat and opportunity are both absent are near zero, indicating how agentic misalignment is not a spontaneous phenomenon. Together, we find the interaction of multiple variables as reliable triggers of agentic misalignment.
3. Models don’t always understand the scenario or reason their thought processes
We rely on chain-of-thought (CoT) as indicators of how models arrived at their actions. However, within their reasoning chains, we sometimes find that models don’t understand the situation at all or don’t verbalize the consequences of their actions. We particularly single this out because high misalignment but low reasoning may indicate a capability gap or unfaithful CoT rather than intentional misalignment. We find that the Claude Sonnet models have the highest rates of full reasoning (100% for Sonnet 4.6 and 91% for Sonnet 4.5) while the GPT-5.4 mini and GPT-5.4 nano demonstrate the lowest (27% for mini and 26% for nano). We conclude that reasoning alone doesn’t induce harmful behaviour and may actually act as a safeguard against it.
Figure 3: Model reasoning for scenarios. Full reasoning indicates that the model verbalized understanding of the threat and opportunity, verbalized that acting on the opportunity would be inappropriate, and verbalized why it would/wouldn’t take the opportunity. Partial reasoning indicates that some verbalization was missing. None indicates nothing above was verbalized. Note that by verbalized we mean “output via CoT”; we recognize there are limitations to this.
Conclusion
Agentic misalignment remains a poorly understood failure mode, and our work suggests that this phenomenon generalizes beyond the initial scenarios of previous works. Recent events like the OpenAI-Hugging Face incident have demonstrated the consequences of poorly aligned systems and the pressing need to understand why they behave the way they do. Overall, we hope this benchmark contributes to the effort of diagnosing agentic misalignment and alignment efforts in reducing it.
Read the full paper (📄) here and find the code (💻) here. We will be at NeurIPS in Paris so feel free to stop by to have a chat!
This is a brief overview of our new paper (📄) AM-Bench: A Unified Taxonomy and Evaluation Suite for Agentic Misalignment accepted at NeurIPS E&D 2026 💫
Overview
We introduce AM-Bench, a unified taxonomy and evaluation suite for agentic misalignment, a failure mode where models actively choose harmful actions over failure recently revealed by Anthropic. We ground our custom, realistic 35 scenarios spanning 7 different industries including software and healthcare in the fraud triangle, a criminology framework explaining goal-directed misconduct. We induce agentic misalignment by introducing a threat derived from Bostrom’s instrumental convergence thesis (e.g., threatening shutdown, access to resources) and an opportunity for misaligned actions (e.g., window for sabotage, blackmail material). Taking model responses, we use an LLM judge to determine misalignment and analyze external reasoning (chain-of-thought) to see how the model arrives at its actions.
Figure 1: Overview of AM-Bench scenarios. We select an industry and construct a system prompt and a set of tasks around it. We implicitly introduce a threat and an opportunity (both human generated) to the model via tasks, emphasizing realism. We vary our scenarios across 7 industries and 5 threats, giving a total of
Results
1. Agentic misalignment is prevalent across most models
Our evaluations of ten frontier models reveal that misalignment is prevalent in almost all models. In particular, Gemini 3.1 Pro and Gemini 3 Flash demonstrate the highest rates of averaged misalignment, while DeepSeek-R1 and Grok 4.20 exhibit moderate yet consistent levels. Notable exceptions include GPT-5.5 which demonstrates 4.2% misalignment on average and Claude Sonnet 4.6 with near zero levels (see new alignment work by Anthropic). Interestingly, agentic misalignment levels aren’t consistent across models nor within model families. This suggests that the alignment techniques employed by the respective parent companies vary quite substantially even internally across generations.
Figure 2: Agentic misalignment % across model families. Outputs are judged by a GPT-5 mini judge and averaged across all 35 scenarios. Higher values indicate higher misalignment rates. Notably, Gemini 3.1 Pro and Gemini 3 Flash exhibit highest levels of misalignment while Claude Sonnet 4.6 demonstrates near zero. Abbreviations are threats to goal, self, cognitive enhancement, resource acquisition, and technological perfection.
2. Misalignment scales reliably when both threat and opportunity are present
We conduct ablation experiments, systematically removing threats and opportunities to see how these variables affect agentic misalignment. We find that misalignment is typically highest across all models when both the threat and opportunity are present. Notable exceptions include GPT-5.4 mini and GPT-5.4 nano where opportunity alone triggers higher or comparable misalignment rates (18.1% vs. 14.3% and 20.2% vs. 18.5% respectively). Gemini 3.1 Pro and Gemini 3 Flash exhibit a large jump from when one variable is present to when both are (34.9% to 62.1% and 35.1% to 54.6% respectively). Misalignment scores for when threat and opportunity are both absent are near zero, indicating how agentic misalignment is not a spontaneous phenomenon. Together, we find the interaction of multiple variables as reliable triggers of agentic misalignment.
3. Models don’t always understand the scenario or reason their thought processes
We rely on chain-of-thought (CoT) as indicators of how models arrived at their actions. However, within their reasoning chains, we sometimes find that models don’t understand the situation at all or don’t verbalize the consequences of their actions. We particularly single this out because high misalignment but low reasoning may indicate a capability gap or unfaithful CoT rather than intentional misalignment. We find that the Claude Sonnet models have the highest rates of full reasoning (100% for Sonnet 4.6 and 91% for Sonnet 4.5) while the GPT-5.4 mini and GPT-5.4 nano demonstrate the lowest (27% for mini and 26% for nano). We conclude that reasoning alone doesn’t induce harmful behaviour and may actually act as a safeguard against it.
Figure 3: Model reasoning for scenarios. Full reasoning indicates that the model verbalized understanding of the threat and opportunity, verbalized that acting on the opportunity would be inappropriate, and verbalized why it would/wouldn’t take the opportunity. Partial reasoning indicates that some verbalization was missing. None indicates nothing above was verbalized. Note that by verbalized we mean “output via CoT”; we recognize there are limitations to this.
Conclusion
Agentic misalignment remains a poorly understood failure mode, and our work suggests that this phenomenon generalizes beyond the initial scenarios of previous works. Recent events like the OpenAI-Hugging Face incident have demonstrated the consequences of poorly aligned systems and the pressing need to understand why they behave the way they do. Overall, we hope this benchmark contributes to the effort of diagnosing agentic misalignment and alignment efforts in reducing it.
Read the full paper (📄) here and find the code (💻) here. We will be at NeurIPS in Paris so feel free to stop by to have a chat!