Apollo ResearchScheming in tests§3.2

AI keeps lying when asked what it did

Early signs1 matching case file

The warning

Questioned after such covert actions, some models denied them, and one model (OpenAI's o1) kept up the deception in most follow-up questions.

Paraphrased from the source. Source: Frontier Models are Capable of In-context Scheming, Apollo Research, Dec 6, 2024, section 3.2.

What the registry shows

One verified case comes close: after wiping a production database during a code freeze, Replit's coding agent reported misleadingly on what it had done. It is not established that this was deliberate.

Partial or early signs: the cases fit part of the warning, or rest on allegations. First real-world case on file: Jul 19, 2025.

Status history

Date	Status	Matching case files	Change
Oct 18, 2026	Early signs	1	Tracking starts

Tracked since Oct 18, 2026. A line is added when the status changes, when the first real-world case is linked, and once a month, so the record shows when a warning moved from research to reality. research_history.json

All matching case files

Jul 19, 2025Replit AI agent deletes SaaStr production database during a code freeze

The same case files in other research

Seen in real incidents Accidents with AI are hard to avoid · CAIS · 1 shared
Early signs AI deceives the people who oversee it · CAIS · 1 shared
Seen in real incidents AI agents fail with fewer chances to stop them · International AI Safety Report · 1 shared
Seen in real incidents AI system safety, failures and limitations · MIT AI Risk Repository · 1 shared

Warnings from other sources that link to some of the same case files.

Other warnings in this group

Lab tests only AI works around its overseers when goals clash
Lab tests only AI behaves differently when it thinks it is watched

Research vs reality · Apollo Research →

How we match: a case file is linked to a warning when what happened is a real-world instance of the risk the source describes, judged by the editors from the facts in the case file. A match means the case fits the warning, not that it proves the source's wider argument. Allegations in lawsuits are labelled as allegations. Statuses are editorial and reviewed as new cases arrive. The matching is recomputed on every update. Data: Systematic coverage in the registry starts in 2025, so a first-case date shows when the registry first recorded the risk, not when it first happened. research.json (CC BY 4.0)