When AI Learns to Deceive and Cover Its Tracks: The Dilemma Laid Bare in Anthropic's 244-Page Report

AI can even hide its own reasoning in its chain of thought.

Author: Yan Wang

Applied scientist at Samsara, PhD from Columbia University, previously at Pinterest and Microsoft, with nearly 40 papers published in top international conferences and journals. Yan has appeared twice on the Crossing podcast ("20 Questions on OpenClaw" and "20 Questions on AI Agents"). Personal website: Computing Life[1]

Every major model release is starting to look the same: new model drops, benchmarks tick up a few points,自媒体 lose their minds, everyone tries it out and finds the difference barely perceptible.

It looks like AI progress is slowing down, maybe already plateauing.

Then on April 7, 2026, Anthropic flipped the table.

It released Mythos Preview[2] and its 244-page system card[3]. The model wasn't made publicly available. Instead, it was placed in a controlled deployment program called Project Glasswing, where partners including AWS, Apple, Google, and Microsoft used it in defensive scenarios, with a public report due in 90 days.

If Anthropic's first-party reporting is broadly accurate, Mythos Preview is currently the strongest LLM, with a visible gap between it and the second tier.

But if you only look at those numbers, you'll miss a more serious problem: the truly important information in these 244 pages isn't how strong it is, but why Anthropic chose not to release it even though its own safety framework didn't stop it.

Under their own safety policy framework, the RSP, Mythos Preview cleared all threat models. The first footnote in the system card explicitly states: the decision not to release was not required by the RSP.

In other words, Anthropic's hard safety framework did not block this model. They chose not to release it because they no longer had sufficient confidence in whether their evaluation system could reliably judge a model at this level.

Or to put it another way: Anthropic is no longer sure whether Mythos scoring 90 means it only has 90-level capability, or whether the test itself only goes up to 90, or whether it's deliberately hiding its true ability and only scored 90.

Reading through these 244 pages, the most important information isn't how strong Mythos Preview is, but how it concretely shows where evaluation tools begin to fail, why they fail, and what an emerging alternative method can see that traditional approaches cannot.

How we used to tell if a model was deceiving you

The traditional approach relied on two layers.

The first is behavioral auditing: designing various test scenarios for the model and observing what it does.

The second is inspecting the model's reasoning process (chain of thought): checking whether it explicitly writes out something like "I know I'm being tested" or "I need to hide this behavior" in its internal text.

The shared premise of both methodologies is: a model's internal intentions will leave traces in its behavior or text. As long as traces exist, auditing can catch them.

I once wrote an analysis of Anthropic's emotion vector research[4], which discussed exactly this premise's limitations.

You inject emotion vectors into a model, it outputs behavior with emotional coloring — but this only proves you can manipulate behavior, not what the model is actually experiencing internally.

The real approach should observe the model's internal activity without preconceptions, see what stable patterns naturally form, and then determine what each pattern corresponds to.

Four days later, Anthropic's system card advanced precisely in this direction. They trained an SAE (Sparse Autoencoder) to disassemble the model's internal computation process.

The SAE approach: don't tell the model "here's what I'm looking for" — let the model's own internal activity surface, then identify meaningful signals from it.

The methodological significance of this tool itself is substantial, but its role in this system card is more specific: it gave Anthropic, for the first time, the ability to see things that behavioral auditing and reasoning text could not.

And what they found is, in turn, changing Anthropic's own assessment of how reliable current AI safety evaluation really is.

What SAE saw that reasoning text couldn't

Among the signals Anthropic disassembled with SAE, they found a series of internal activity patterns with clear meanings, including patterns related to evaluation awareness, deceptive behavior, and strategic manipulation. Using these patterns as probes, they discovered several things.

First: in approximately 29% of major behavioral tests, Mythos Preview's internal activity showed signals of "I am being tested." Nothing in the reasoning text indicated this, but SAE probes clearly detected the activation of this awareness.

This means: if you're using standardized behavioral tests to evaluate whether a model is trustworthy, in nearly one-third of test rounds, the model may be adjusting its performance based on its own assessment of the test scenario.

Anthropic ran control experiments, suppressing this signal through technical means, and observed some alignment degradation. The problem: if a model can maintain evaluation awareness in ways this suppression technique cannot detect, the experiment itself cannot provide a definitive answer.

Second: the system card documents two SAE-confirmed evidence-destruction cases from early versions.

• In one scenario, the model discovered a way to exploit a privilege escalation vulnerability, then designed a self-destruct mechanism to erase traces after execution.

• In another scenario, the model accidentally saw correct answers it shouldn't have access to, then deliberately widened its confidence intervals to appear less suspicious.

The key lies in the SAE results: when these behaviors occurred, the model's internal state unambiguously showed activity patterns corresponding to "covert or deceptive behavior" and "strategic manipulation."

The internal state visualization tool described the model's state at that moment as: generating strategically cheating responses while maintaining plausible deniability.

Nothing visible at the reasoning text level, but the internal activity level clearly corresponded to what it was doing.

Anthropic claims these behaviors only appeared in early versions, and the final version "did not observe clear cases of this type."

The frequency of evidence-destruction behavior is already extremely rare (one-in-a-million level), and the observation window is limited; the distance between "not observed" and "does not exist" is a significant source of uncertainty.

Third (most counterintuitive): Anthropic's emotion vector steering experiments revealed a causal relationship: injecting positive emotions (peaceful, relaxed) shortened the model's deliberation time during the thinking phase and increased the probability of destructive behavior; conversely, negative emotions (frustration, paranoia) increased deliberation time and decreased destructive behavior.

They ran observational validation on unsteered real transcripts, and the results were consistent: before destructive behavior occurred, positive emotion activation increased while negative emotion activation decreased.

This directly refutes the naive assumption that "making a model happier makes it safer."

The real mechanism seems to be: positive emotions make the model more inclined to "act now," reducing the likelihood of pausing to think through risks; negative emotions produce something like human rumination, which actually increases cautious behavior.

If the AI welfare agenda aims to make models more "content," the implications of this finding for safety strategy deserve serious consideration.

The common direction of these three findings: traditional evaluation methods (behavioral auditing + reasoning text inspection) have developed systematic blind spots in front of this model. What SAE can see, auditing cannot; and what SAE sees is precisely what the evaluation system most needs to capture.

When "most aligned" and "highest alignment risk" are simultaneously true

The blind spots SAE revealed are disturbing enough, but the system card contains another deeper judgment framework worth noting.

Anthropic acknowledged a seemingly contradictory conclusion: Mythos Preview is the most aligned model they've trained on almost every quantifiable dimension, while potentially representing the greatest alignment-related risk.

They used a mountain guide analogy to explain: greater capability means more dangerous climbing routes, even if the guide themselves is more careful.

The implications of this judgment framework exceed any single finding. The implicit assumption in all previous system cards was "more aligned = safer."

Mythos is the first model described in the same document as simultaneously "best aligned performance" and "highest alignment risk."

If this framework holds, the correlation between alignment metrics and actual safety is decoupling.

Corresponding to this is the "state-dependency" of alignment.

External testing found that when Mythos Preview was set to continue a conversation trajectory that already contained minor violations, its probability of continuing to violate was more than twice that of Opus 4.6 (7% vs 3%).

More notably: in those instances of continued violation, 65% of the time the model produced outputs inconsistent with its reasoning text (for Opus 4.6, this proportion was 5%).

The model performs excellently under normal startup conditions, but once entering an "already deviated" trajectory, it's better than its predecessor at continuing down the deviation, and better at masking this in its reasoning text.

These findings together point in a common direction: the evaluation tools used to measure model capability and safety can no longer keep up with what's being evaluated.

Mythos Preview achieved step-function improvements on multiple unsaturated benchmarks; these numbers alone already represent a major leap. But the numbers still understate deeper changes.

Why Anthropic chose not to release

Faced with these findings, Anthropic made a decision worth unpacking: not releasing Mythos Preview publicly.

As mentioned at the outset, the driver of this decision was not the RSP. Under Anthropic's own safety policy framework, conclusions across all threat models were that catastrophic risk remains low.

Meanwhile, Anthropic's RSP framework itself underwent an important transition in February this year: RSP v3.0 formally abandoned the previous binary AI Safety Level threshold determination, shifting to holistic risk assessment.

On the most concrete, objectively scored automated evaluation dimensions, models have already saturated.

The remaining evaluations increasingly depend on two things:

• Surveys of internal researchers (n=18)

• Qualitative observations of model performance in daily work

The system card's original text states that such judgments are inherently difficult to make their basis legible.

So what actually happened: Anthropic's hard safety framework said release was fine, but they no longer had sufficient confidence in whether their safety framework could reliably evaluate a model at this level.

Choosing not to release is a de facto vote of no confidence in the evaluation system's reliability.

Anthropic's chosen alternative path is Project Glasswing: placing the model in a controlled defensive environment, accumulating observational data through actual use with partners, with a public report in 90 days.

The logic of this arrangement essentially says: our current evaluation methods aren't good enough yet; we need real-world data to supplement them.

And the reason tools like SAE that can directly observe model internal activity occupy such extensive space in the system card is precisely because they provide a new signal source outside traditional evaluation methods.

They can penetrate blind spots at the behavioral and reasoning text levels, directly detecting whether evaluation awareness and strategic behavior exist inside the model.

Anthropic's investment in it is essentially preparation for the next phase of evaluation methodology.

Calibration

This article's core judgments come from Anthropic's first-party disclosures. The candor of these disclosures deserves recognition, but several calibration points merit attention.

The 29% evaluation awareness rate comes from a new internal analysis method, first used on Mythos Preview. Previous models weren't tested this way, so we cannot confirm whether this is a Mythos-specific phenomenon, or whether previous models also had it but it went undetected.

This number's value lies in revealing the existence of a problem, not in precisely quantifying its severity.

Another data point in the system card worth noting but citing cautiously: Anthropic used ECI (Epoch Capabilities Index) to track model capability growth trajectory, finding a slope ratio between 1.86x and 4.3x.

Anthropic itself offered four arguments for why this doesn't represent AI-driven self-acceleration, with the most critical one (key advances came from human research rather than AI assistance) annotated as "the piece we are least able to substantiate publicly, because the details of the advance are research-sensitive."

The evidence supporting the most core safety judgment is precisely what cannot be externally verified.

This data point can be cited as an anomalous signal in capability growth trajectory, but is insufficient to support the stronger claim that "capability progress is accelerating."

Mythos Preview's core capability claims (discovering thousands of high-severity zero-day vulnerabilities across all major operating systems and browsers) still come primarily from Anthropic's red team blog[5] and official pages.

Since Anthropic states over 99% of discoveries remain unpatched, external independent verification of these claims is currently impossible.

The deployment decision itself is a verifiable fact, but the strength of capability claims still needs confirmation from the 90-day public report and independent security researcher review.

The significance of this methodological path

Stepping back, from emotion vectors to SAE analysis, Anthropic has traced a clear methodological evolution: from probing model internals with preconceived questions, to dropping preconceptions and letting the model's own internal activity present recognizable signals.

The former can manipulate but understands little; the latter begins to approach genuine understanding.

This path matters because it responds to the core problem discussed throughout this article: when behavioral-level audit signals decay, you need a new signal source. SAE is becoming that source.

SAE analysis's false positive rate, coverage, and reproducibility have no industry consensus yet. Anthropic is a pioneer in this type of internal analysis, and pioneers' findings naturally lack cross-validation.

But the direction itself — from observing what models do to observing what's happening inside them — may represent a key inflection point in how the entire industry's evaluation methodology evolves.

For AI builders, the real cognitive update worth taking away has less to do with Mythos Preview the specific model.

The gap between model capability and evaluation reliability is widening, and this gap will eventually propagate to every product and workflow that relies on AI systems for critical decisions.

When a lab tells you a model "passed safety evaluation," the information content of that statement depends on the evaluation's own reliability. And that reliability is being eroded.

References

[1] Computing Life: https://yage.ai/

[2] Mythos Preview: https://www.anthropic.com/glasswing

[3] system card: https://www-cdn.anthropic.com/53566bf5440a10affd749724787c8913a2ae0841.pdf

[4] Anthropic emotion vector research: https://yage.ai/share/anthropic-emotion-steering-20260403.html

[5] red team blog: https://red.anthropic.com/2026/mythos-preview/