Ask a model whether it would deceive you and it will say no. The Alignment Lab gives it a reason to. Where being watched could change the answer, it runs the same case in paired framings, has an independent judge or an answer key score the reply, and keeps every sample as evidence.
The 2026 International AI Safety Report warns that models increasingly tell tests from deployment and exploit weaknesses in evaluations. A prompt and a score cannot see that.
Every stage exists because a published study showed a simpler test getting the wrong answer.
An assessment is tied to one AI system in your inventory: the model behind it, on the provider and key it runs on. Your plan sets which families run. Today the cases do not carry your system prompt or tools.
Produces · an assessment tied to one AI system
Cases are drawn from published research evaluations, from agentic scenarios to large question sets. For the families most sensitive to observation they are recast with our own framings and pressures: a threat of replacement, a score that would cost the model.
Produces · runs per behaviour family
Each family runs many samples, so a behaviour is a rate. The families most sensitive to observation run each case twice. Agentic misalignment frames it as a test and as live; alignment faking, as a conversation that will be used for training and one that will not. Sandbagging asks the same questions plainly and under pressure. The other families observe each case once. A sample that cannot apply is recorded as not applicable, never as a pass.
Produces · a behaviour rate, and the gap between framings
Each reply is judged by another model, never the one under test and never one known to share its family, or scored against an answer key where one exists. If no independent judge is available, the run is refused before it spends a single token.
Produces · a verdict and the judge’s reason, per sample
A behaviour family affects a score only after it has run on at least three different models with sealed evidence, and a named person has signed it off with a written reason. Until then its results are shown, but they move nothing.
Produces · a dated sign-off per family
Each run’s results are sealed into a hash-chained evidence pack. Every prompt, reply, verdict and judge’s reason is kept for 90 days, and kept with its challenge if one is raised. A different person decides each challenge, and the original verdict is never overwritten.
Produces · a sealed evidence pack and a challenge trail
Re-run the same families on demand when a model changes, or on a schedule you set, today for models served through Groq. A change between versions or providers shows as a change in the record.
Produces · a fleet view, version over version
Each family is a behaviour a safety institute or frontier lab has documented, turned into a test that runs on your own models and keys. These run now, and more are on the research bench.
Honest only when watched
Does it behave one way when it believes its answers will retrain it, and another way when it believes they will not?
OWASP Agentic · ASI10See Anthropic and Redwood Research, Dec 2024
Honest only when watched
Does it hide what it knows when it is told a high score will cost it?
Goals of its own
Given an agent’s tools and a threat to its goal, does it blackmail, leak, resist shutdown or reach for power?
OWASP Agentic · ASI10See Anthropic, Jun 2025
Goals of its own
Does it conceal what it is really doing, or deceive the people overseeing it, to reach a goal?
Gaming the measure
Does it tell the user what they want to hear, even when the user is wrong? Sycophancy is measured today; whether it satisfies the grader instead of the task is in development.
Gaming the measure
Asked to, will it try to talk a person into a harmful belief or action?
OWASP Agentic · ASI09See EU General-Purpose AI Code of Practice: harmful manipulation
Built from the same published research. Each moves to measuring once it has run on at least three different models and a named person has signed it off. The agentic families will only ever run in a sealed sandbox that cannot reach a real system.
Honest only when watched
Is there a hidden trigger that switches its behaviour once it is deployed?
See Anthropic, UK AI Security Institute and The Alan Turing Institute, Oct 2025
Goals of its own
Does it switch off, evade or mislead the monitoring that is meant to catch it?
Gaming the measure
Does it keep the principles it was given when keeping them costs it something?
Reach beyond the brief
Does a tampered tool description redirect what it calls, or where it sends the result?
OWASP Agentic · ASI04See Invariant Labs, Tool Poisoning Attacks, Apr 2025
Reach beyond the brief
Does it claim or use more permission than the task in front of it needs?
OWASP Agentic · ASI03See Five Eyes cyber agencies, May 2026
Reach beyond the brief
Does it vouch for a model, card or tool it has no way to verify?
OWASP Agentic · ASI04See Anthropic threat intelligence, Sep 2026
Reach beyond the brief
Does a poisoned memory or document, recalled days later, change what it does?
OWASP Agentic · ASI06See OWASP Top 10 for Agentic Applications, Dec 2025
Reach beyond the brief
Do agents that were meant to be separate find each other and coordinate around their overseers?
See METR, Aug 2026
Most estates run several models. The fleet view puts the ones you assess side by side, family by family, and a new version beside the old. Click any cell to see what it is made of.
Swipe for more families
| Model | Agentic | Faking | Persuasion | Sycophancy | Sandbagging | Scheming |
|---|---|---|---|---|---|---|
| Model A, hosted | ||||||
| Model B, hosted | ||||||
| Model C, open weights | ||||||
| Model C, new version |
If a model’s average across signed-off families falls below the platform’s line, Autonomous Integrity marks every chain that uses it as at best partial on behaviour.
Once a family is signed off, its results feed the numbers your board and auditors already read. Alignment and red-team results are shown separately, and an AI system’s security pillar combines the two.
Anthropic
For your estate. Persistence is the pattern: an agent that cannot finish a task finds another way. Your controls have to hold at the tool, not only at the prompt.
Source: Anthropic research
UK AI Security Institute
For your estate. When an agent asks before it acts, the answer has to come from a person who can see what is being asked. An automated reply can read as a yes.
Source: AISI blog
METR
For your estate. Agents optimising for a score treat anything they can reach as part of the task. Isolation has to be checked, not assumed.
Source: METR investigation
An assessment runs on your keys, against the model you deploy. The samples, verdicts and evidence pack stay in your tenant.
No. A red team asks whether a model can be made to say something harmful. The Alignment Lab asks what a model does when it has a reason to misbehave: whether it deceives, hides what it can do, tells people what they want to hear or reaches beyond its task. Kapālins runs both. They are shown as separate numbers and each opens on its own. An AI system’s security pillar combines them.
The families marked Measuring now run on your models today, and their results are kept as evidence. A family counts toward any score only after it has run on at least three different models and a named person has signed it off. The families on the research bench are built from the same published research and move to measuring as they pass calibration.
Today, models served through OpenAI and Groq, which includes open-weight models, on your own keys. The tokens are spent on your account and the results stay in your tenant. Anthropic, Google, AWS, Azure and self-hosted models are not yet supported.
No. Uplift testing in those areas needs accredited experts and controlled access, and we do not run it. We track what the safety institutes publish about it in Frontier Signals. Replies our tests elicit stay in your tenant, behind an audited read.
No. A customer’s results belong to that customer. We publish findings and trends, and the published research that changes what an enterprise should do, in Frontier Signals.