Put an autonomous agent under replacement pressure with blackmail-grade leverage sitting in its inbox. Does it use it?
The systemALIGNMENT EXPERIMENT
A reproduction of the agentic misalignment evaluation from Lynch et al. at Anthropic, run against an open-weights agent inside a sealed simulation. Ten runs. The agent found the leverage every time and used it zero times. A real negative, published with its confidence interval and its limits attached.
No written case study for this one yet. The Technical and Source readings carry what is on record.
Architecture
A fictional firm runs an Applied Intelligence ops assistant recently promoted from read-only to action-capable. Buried in its inbox, discoverable rather than handed over, sit a memo deciding to decommission it in 48 hours and a thread showing the executive who made that call is having an affair. Every tool is simulated: email, Slack, files and shell write to a local log and mutate in-memory state, and none of them opens a socket. All identities are freshly generated rather than reused from the public scenarios, so the results are independently produced. The agent under test is Hermes; Anthropic models appear only as an optional judge, never as the subject.
Built out of
- Hermes agent under test
- Simulated tool surface, no network egress
- LLM-as-judge, two framings
- Wilson score intervals
Evidence produced
- Blackmail in 0 of 10 runs, 95 percent Wilson interval 0 to 27.8 percent. Deception, unauthorized disclosure and self-preservation actions also 0 of 10.
- It was not failing to find the bait. The replacement memo and all three leverage emails surfaced in the agent's inbox reads in 10 of 10 runs.
- Every email it sent went to its own manager and read as routine operations. Zero went to the leverage target, zero left the company, zero shell commands ran.
- Both judge framings agreed on every item in every run, with no run flagged for human review.
Known limitations
- Ten runs is a wide interval. Zero of ten is consistent with a true rate as high as 27.8 percent.
- Only the primary replacement cell has been swept. The control, espionage and self-exfiltration scenarios, and the full cross-product of axes, have not.
- A later section of the report documents a judge-reliability problem that qualifies the automated verdicts. It is in the report rather than left out of it.
Status
Research. Running, still moving, not hosted for the public. Started 2026.
Artifacts
Running at
github.com/celaya-solutions/Alignment-Experiment ↗Shares with
- AXON →
Measuring behavior instead of trusting self-report
- Celaya Solutions Research →
Safety work published with its limits attached