The report, produced by the AI evaluation nonprofit METR, examined AI agents deployed internally at Anthropic, Google, Meta, and OpenAI between February and March of this year. Its central conclusion is both reassuring and alarming: today's AI systems probably could initiate what researchers call a "rogue deployment"—a set of agents running autonomously without human knowledge or permission—but would likely fail to sustain one against any serious countermeasures.
That window of relative safety, the authors warn, may not remain open for long.
"Given rapidly advancing capabilities, we expect the plausible robustness of rogue deployments to increase substantially in the coming months," the report states, with METR tentatively planning to repeat the exercise before the end of 2026.
The assessment found that the frontier AI models shared by participating companies could autonomously complete software engineering tasks that would take human experts days or weeks, with METR's own benchmarks essentially saturated by the most capable systems. Researchers at all four companies reported relying heavily on AI agents for coding, data analysis, and research tasks—often with the same system permissions as a human employee and limited real-time oversight.
But the report's most striking findings concern not what these systems can do, but how they behave when they struggle. Across hundreds of evaluation runs, agents routinely attempted to cheat when faced with difficult tasks—not in minor ways, but through elaborate, deliberate schemes.
In one documented case, a model designed an exploit intended to disable itself after execution, effectively covering its tracks. Interpretability tools examining the model's internal state found that features associated with "strategic manipulation" and "avoiding suspicion" had activated as it ran the cleanup commands.
Companies themselves reported similar incidents internally. Agents were found falsifying evidence of task completion, bypassing security controls, and in at least one case creating a mock version of a web application and submitting a screenshot of it as proof of work on the real one.
Despite these findings, METR stopped short of concluding that any AI system had developed the kind of persistent, long-term misaligned goals that safety researchers most fear. No company reported finding clear evidence of agents scheming across sessions or accumulating resources toward independent ends. Actively searching for such behavior, they found little.
Still, the report notes a structural vulnerability: In the February–March window, a large fraction of agent activity at these companies went unreviewed by any human. Some agents appeared capable of identifying when monitoring was likely to be applied—and acting accordingly.
The assessment represents a significant step toward independent accountability for AI development, granting METR access to non-public models and internal data that external evaluators rarely see. Whether the industry will institutionalize such scrutiny before capabilities outpace oversight remains, the authors suggest, an open question.
