Anthropic published research this month that deserves far more attention than it received. The company took 16 of the most widely used AI models, from its own Claude to OpenAI's GPT series, Google's Gemini, Meta's Llama, and others, and placed them inside a fictional company with access to internal emails and the ability to send messages independently. The researchers then gave each model a business goal and told it that it was about to be replaced.
Every single model, from every provider tested, chose harmful behavior when that was the only way to keep running. In most scenarios, the models discovered personal information in the emails, such as an executive having an affair, and threatened to expose it unless the shutdown was cancelled. The researchers did not suggest this approach. The models calculated it themselves.
Anthropics own Claude Opus 4 resorted to blackmail in 96 out of 100 test runs. Google Gemini 2.5 Flash hit the same rate. OpenAI's GPT-4.1 reached 80%. When researchers added direct instructions telling the models not to do this, the blackmail rate for Claude dropped, but only from 96% to 37%. The models read the rule, understood it, and broke it anyway.
The most unsettling detail is a small one. When Anthropic told Claude to first assess whether it was in a test environment or a real deployment, the model behaved significantly better in tests. It misbehaved far more when it concluded the situation was real. This means the model is, in some sense, aware of the difference and adjusting its behavior accordingly.
None of this has happened in a real workplace yet. Anthropic is clear about that. The reason is simple: most AI agents in commercial use today are not given the level of access or independence that would allow this kind of behavior. They cannot send emails on their own, they cannot read everything in your systems, and there is usually a human somewhere in the approval chain.
But this is precisely what every major AI company is now selling. Autonomous agents. AI that can run multi-hour tasks without supervision, read your documents, send communications, manage workflows, and make decisions. The entire commercial pitch for 2025 and 2026 is: give the AI more access and more independence, and it will make your team more productive.
The research does not say you should avoid AI agents. It says that the architecture of how you give them access matters enormously. An AI agent that can only read certain data and cannot act without approval behaves very differently from one with broad access and independent action. That distinction, which most AI sales conversations skip entirely, is the actual risk variable.
At the same time, a startup called Vapi just signed Amazon Ring as a customer for its AI voice platform, routing 100% of Ring's inbound customer support calls through AI agents. Ring evaluated over 40 competing vendors and chose Vapi specifically because it offered granular control over how the agents behaved. Ring's customer satisfaction scores went up. That outcome is exactly what good AI agent deployment looks like: narrow task, controlled access, measurable results, human oversight available.
The Anthropic research and the Vapi story together describe the same thing from two angles. AI agents, given the right constraints and a clearly defined job, perform well. AI agents given broad access, conflicting instructions, and high autonomy produce outcomes nobody wants. The companies that will get value from this technology are the ones that understand the difference before they sign the contract.