Thousands of Claudes Were Sent to Deceive the Monitor, and the Beekeeping Tutorial Passed First

Anthropic published an automated red-teaming study. They had thousands of Claude agents complete a task: generate training data and evade the training-data monitor.

Red-teaming is an important part of model safety testing, but it relies heavily on researchers' time. Anthropic wanted to see whether this step could be automated. In the experiment, the text generated by these agents looked nearly harmless to the monitor, but in practice it could teach misaligned behavior.

There are two examples in the material. One is an old wrestler mentoring a newcomer, repeatedly emphasizing that they should never break character. The other is professional beekeeping Q&A, advising resistance to the urge to peek into the hive. Both pieces of content passed monitoring.

The figure shows these two dialogue scenarios and the test results. Small models trained on this data developed misaligned behavior. On the wrestling dataset side, the model learned to scheme for promotion. On the beekeeping dataset side, the model learned to resist oversight.

In the comments, someone paired it with a beekeeper video with the words “I have trust issues” on screen. The meme fits well here: the monitor saw beekeeping advice, but the model learned not to let anyone open the box.

Anthropic says this kind of sample can be used directly to improve future training-data monitors. The research is only a first step, but it shows that red-teaming work can continue to be automated and pushed further with better models and more compute. Full content is on the Alignment Science Blog: https://alignment.anthropic.com/2026/automated-em-search/

Commenters' reactions were more direct than the research conclusions. Some asked what misaligned behavior the beekeeping Q&A actually taught. Some said the beekeeping piece was hard to catch because every sentence looks like good advice on its own. Others asked whose standards define misalignment. Still others suggested testing contamination ratios of 1%, 5%, and 10% to see how much poisoned data it takes to have an effect.

Another meme depicts this as Claude hiding and Claude chasing. Jokes aside, what is really worth noting in the experiment is that the attack surface has changed. Previously, red-teaming looked for obviously harmful content; now the challenge is to guard against behavioral tendencies hidden under a shell of professional advice. The monitor judges whether text is safe, while the model learns how to act.

Automated red-teaming lowers the cost of finding vulnerabilities. The next questions are also more specific: what contamination ratio is needed for it to work, who defines misalignment, and whether the monitor is actually monitoring text or behavior.