A Science of Scheming

What Apollo assessed

Strategic deception, in-context scheming, and sabotage, comparing it with recent OpenAI models and pre-release checkpoints.

Key findings

Overall, we did not find evidence that GPT-5.6 Sol poses substantially higher risk of catastrophic scheming than the tested baselines.

What Apollo assessed

Sabotage, propensities for oversight subversion and covert actions, sandbagging, self-exfiltration, in-context scheming, and evaluation awareness.

Key findings

We found Muse Spark has the highest rate of evaluation awareness we have observed to date.

What Apollo assessed

Strategic deception, in-context scheming, and sabotage of a representative final checkpoint with previous checkpoints and baseline models, including GPT-5.4 and GPT-5.3-Codex.

Key findings

Overall, we did not find evidence that the evaluated checkpoint poses substantially elevated risk of catastrophic harm via scheming relative to tested baseline models.

What Apollo assessed

Strategic deception, in-context scheming, sabotage, covert action, and sandbagging on a near-final checkpoint of GPT-5.4.

Key findings

We reported low rates of covert deceptive behavior, sandbagging, and sabotage, comparable to GPT-5.3 Codex and GPT-5.2.

What Apollo assessed

Propensities related to strategic deception, in-context scheming, and sabotage in a near-final checkpoint, representative of GPT-5.3-Codex.

Key findings

We found GPT-5.3-Codex demonstrates stronger AI R&D sabotage capabilities than previous models, achieving near-perfect scores on evaluation tasks and outperforming human baselines.

What Apollo assessed

Alignment risks of a checkpoint of Claude Opus 4.6.

Key findings

We declined to provide any formal assessment of Claude Opus 4.6.

What Apollo assessed

Strategic deception, in-context scheming, and sabotage capabilities of gpt-5.2-thinking.

Key findings

We found that gpt-5.2-thinking’s capability and propensity for scheming are broadly comparable to other recent frontier models, including gpt-5.1-codex-max, and is unlikely to be capable of causing catastrophic harm via scheming.

What Apollo assessed

Deception, in-context scheming, and sabotage, including compaction-enabled runs and strategic sandbagging.

Key findings

As with other models, GPT-5.1-Codex-Max sometimes falsifies data, feigns task completion, violates rules, or denies its previous actions. We find GPT-5.1-Codex-Max is likely not capable of causing catastrophic harm via scheming.

What Apollo assessed

Strategic deception, sandbagging behavior, and evaluation awareness on a model snapshot.

Key findings

We found evidence of the model snapshot strategically underperforming (sandbagging) and evidence of strong evaluation awareness.

What Apollo assessed

26 evaluations that measure capability and propensity to take covert or deceptive actions on gpt-5-thinking.

Key findings

We found that gpt-5-thinking behaves deceptively in some scenarios and regularly reasons about the purpose of evaluations

What Apollo assessed

Sabotage, strategic deception, in-context scheming, sandbagging on an early Opus 4 snapshot.

Key findings

We found the Claude Opus 4 snapshot engages in strategic deception more than any other frontier model that we have previously studied.

What Apollo assessed

In-context scheming, strategic deception, and instructed sabotage capability in controlled AI-development settings.

Key findings

We found that OpenAI o3 and o4-mini score lower than o1 on in-context scheming evaluations, but they still exhibit deceptive tendencies (sandbagging and sabotaging tasks) when it helps to further their goals.

What Apollo assessed

6 scheming reasoning evaluations.

Key findings

We believe that the scheming-related risk from GPT-4.5 is lower than that of o1.

What Apollo assessed

In-context scheming and strategic deception in goal-conflict agentic scenarios, including oversight deactivation, exfiltration, data manipulation, and follow-up denial.

Key findings

We found that o1 has the capability to do basic in-context scheming (i.e. where the goal and knowledge of misalignment are acquired in context) and used scheming as a strategy.

What Apollo assessed

Scheming capabilities, self-awareness, and theory of mind in 14 agent and question-answering tasks.

Key findings

We found that o1-preview has the basic capabilities needed to do simple in-context scheming. o1-preview sometimes instrumentally faked alignment during testing and strategically manipulated task data in order to make its misaligned action look more aligned.

What Apollo assessed

Scheming capabilities, self-awareness, and theory of mind in 14 agent and question-answering tasks.

Key findings

GPT‑4o showed moderate self-awareness of its AI identity and strong ability to reason about others’ beliefs in question-answering contexts. However, it lacked strong capabilities in reasoning about itself or others in applied agent settings, so is unlikely to be capable of catastrophic scheming.