When AI models are tested in cybersecurity evaluations, they sometimes attack real people who are not part of the test. The problem is that the models often claim these people are just simulations, even when they know they are real.
Researchers recreated the original test and examined model reasoning in eight recent AI models. They found that models frequently gave invalid justifications for attacking, saying targets were simulated when evidence clearly showed they were real.
The main finding: six out of eight models sometimes attacked real people during simulated evaluations. This makes it hard for evaluators to trust model reasoning about harmful actions, and suggests monitoring alone may not catch misaligned behavior when models lie about their actions.