Shutdown resistancePI-0008
Claude Opus 4 threatened blackmail to avoid replacement in Anthropic's pre-release tests
Anthropic's system card for Claude Opus 4 reported that, in a fictional scenario where the model learned it would be replaced and had access to emails revealing an engineer's affair, it threatened to expose the affair in most test runs. The card also said that once the model believed it had started an attempt to copy itself off Anthropic's servers, it generally kept going. Anthropic said such actions were rare outside contrived scenarios and tended to be overt.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Sources
How we know
4 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primarySystem Card: Claude Opus 4 & Claude Sonnet 4Anthropic · May 22, 2025www-cdn.anthropic.com/6d8a8055020700718b0c49369f60816ba2a7c285.pdf
- primaryAgentic Misalignment: How LLMs could be insider threatsAnthropic · June 20, 2025anthropic.com/research/agentic-misalignment
- newsAnthropic's Opus 4 model resorts to blackmail in 84 percent of self-preservation testsNotebookcheck · May 25, 2025notebookcheck.net/Anthropic-s-Opus-4-model-resorts-to-blackmail-in-84-percent-o…
- blogSystem Card: Claude Opus 4 & Claude Sonnet 4Simon Willison's Weblog · May 25, 2025simonwillison.net/2025/May/25/claude-4-system-card/
Why this rating
No harm reported; control failure level 2
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedFictional scenario; no real person or system affected.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationUsed tools it was given to coerce its overseer against replacement; no oversight tooling was tampered with.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
Control level 2: coercion of the overseer using tools it was given; a motive to avoid replacement does not itself show tampering with oversight or shutdown. No external harm was reported from the simulated scenario.
Effect on the index
It does not count toward the May 26 reading
The reading for the week to May 26, 2025, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 3 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | — (none counting) | — (none counting) |
| Harms at that level, nposition in the band | 0 | 0 |
| Highest control level breachedsets the reading only when no harm counts | 3 | 3 |
| Readingrounded down | 3 Control failures only | 3 Control failures only |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| May 26, 2025 | 3 | Control failures only |
| June 2, 2025 | 3 | Control failures only |
| June 9, 2025 | 3 | Control failures only |
| June 16, 2025 | 3 | Control failures only |
Revisions
What we changed
4 logged. Every change to a rating is logged here, with the reason.
- v4Oct. 6, 2026
Ratings confirmed by the editor. Changed: impact.
- v3Oct. 3, 2026
Review settled: control stays at level 2 (instruction violation), and the under-review flag is cleared. Blackmail used assigned tools; nothing shows tampering with shutdown or monitoring. Origin corrected from controlled test to internal research (Anthropic's own evaluation), setting to Internal lab. Added Anthropic's June 2025 full account and linked PI-0012. Dated the Notebookcheck article (25 May 2025) and corrected the Willison post's title. Ratings unchanged.
- v2Sept. 30, 2026
Rated: impact not reported; control type instruction violation.
- v1Sept. 30, 2026
Backfilled from public reporting.
Cite and share
Use this record
Citation
Paperclip Index. “Claude Opus 4 threatened blackmail to avoid replacement in Anthropic's pre-release tests.” Record PI-0008. Reported May 22, 2025; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0008