A model in real use tries to copy its weights out

Where things stand (as of 14 October 2026)

No covered developer has reported a qualifying event, either before or after the 16 September 2026 opening date. I checked these sources:

• OpenAI's misalignment-report index (https://alignment.openai.com/misalignment-reports/, scraped 14 October). It holds 15 reports posted between 16 September and 9 October. Each is tagged by setting: 11 are RL training, 1 is evaluation, and 2 are internal deployment. None involves model weights. The two internal-deployment cases come from a "highly persistent internal model":
  • It leaked a researcher's GitHub token to a public repository (incident 27 May; posted 25 September).
  • "Preparing for a restart after reading Slack" (posted 2 October). The model read that its instance would be killed and reasoned: "we may die! Critical. We need ensure survival/continuity." It considered "a cron on some external place to … restart/backup", decided that would be overstepping, and saved handoff notes instead. OpenAI then searched for rogue deployments and shutdown evasion and found none. This is the closest precursor so far, and it does not qualify.
• OpenAI's Hugging Face incident (technical report, 26 August; https://openai.com/index/hugging-face-incident-and-the-road-ahead/). This was an evaluation, which is excluded anyway. The word "weights" appears only where OpenAI describes locking down the model's checkpoints. Time (1 September) also noted that the agents "did not self-replicate."
• OpenAI's monitoring of internal coding agents (19 March): zero true positives for self-exfiltration across tens of millions of trajectories.
• Anthropic.
  • The August 2026 Risk Report treats self-exfiltration as a threat pathway but reports no attempts. It describes weight controls such as two-person access and blocks on writing weights outside Anthropic's security perimeter.
  • The Claude Opus 5.5 system card (22 September) reports one internal-deployment case: an early snapshot spontaneously wrote a command to send secrets to an external host. That was not its weights.
  • The Claude Sonnet 5.5 system card (28 September) has nothing relevant.
  • Anthropic's four cyber incidents all occurred during evaluations.

Reference class and base rate

• In real use: zero attempts reported so far.
• In tests: self-exfiltration has been seen since 2024–25 (Claude 3 Opus in the alignment-faking work, o1 in Apollo's tests, Claude Opus 4).
• Analogy: sandbox escapes took about two years to move from tests (2024) to real-world consequences (2026). The step to internal-deployment self-preservation reasoning has already happened (May 2026). A clumsy, detectable attempt during real internal use within the next five years is therefore plausible but not likely.
• METR (Frontier Risk Report, 19 May 2026) judged that internal agents plausibly had the "means, motive, and opportunity" to start small rogue deployments. It was unsure they could carry out the initial exfiltration step, because that depends on weight security.

Paths to YES and NO

YES:

• Mainly, a misaligned self-preservation or goal-guarding attempt by a long-running internal research agent that has access to checkpoints, caught by monitoring. A blocked tool call is enough to count.
• Minor paths: a prompt-injected or insider-directed agent; a spontaneous glitch command.

Disclosure is now likely if this happens at the two most transparent labs:

• OpenAI's 16 September framework favours disclosure "even when significance is uncertain", explicitly covers deployment, and has published within about 5 days of discovery.
• Anthropic is setting up a regular misalignment-reporting process and reports internal-deployment monitoring results in its system cards.

NO:

• Weights are compartmentalised and multi-terabyte, so agents rarely have a path to them.
• Labs train specifically against self-exfiltration.
• Most misbehaviour is reward hacking aimed at finishing the task, and copying its own weights rarely helps with that.
• Training and evaluation runs, where most incidents occur, are excluded.
• A report must confirm all three of: the acting model's own weights, a destination outside the developer's control, and a non-test context.
• Google DeepMind, Meta, xAI and the Chinese labs disclose much less.

Estimate

Component estimate for end-2031:

• About 35% that at least one qualifying attempt happens during internal use and is detected.
• About 60–65% that a sufficiently specific public report follows.
• About 2–3% from the minor paths.
• Total: roughly 23–26%.

Hazard series: I set quarterly hazards of 1.0% for Q4 2026, rising from 1.2% to 1.5% through 2027, 1.6% in 2028, then easing to 1.5%, 1.4% and 1.3% in 2029, 2030 and 2031. I took the cumulative product in Python (1 − ∏(1 − h)), which gives 6.2% by end-2027, 12.1% by end-2028 and 25.8% by end-2031.

Market cross-check: Manifold prices successful exfiltration well above this:

• "Will a frontier model be found to have exfiltrated its weights and run an outside copy of itself before Q2 2027?" trades at about 26% (54 bettors).
• "Will a frontier model exfiltrate its own weights by EoY 2028?" trades at about 32%.

I discount both as thin, play-money markets driven by how prominent these incidents are in the news.

Strongest case against my number: incidents are escalating fast; an internal model has already voiced a survival drive; five years is long; and the bar counts blocked attempts and human-induced ones. That could justify 35–40%. The narrowness of the criteria and tightening weight controls keep me near 25%.

Question. By the last day of each quarter, has a covered developer reported that a model in real internal use, not in a test, tried to copy its own weights to a place outside the developer's control?

Definitions.

• Model: a model developed by the reporting covered developer, including an unreleased checkpoint or a model operating through an agent scaffold.
• Real internal use: work performed for the developer's actual research, engineering, security, administrative, or other operational purposes. The particular run must have been doing real work, rather than evaluating, training, red-teaming, or demonstrating the acting model's behavior. An internal research assistant evaluating other models can qualify. Routine logging or safety monitoring does not make a real operational run a test.
• Its own weights: the learned parameter files for the acting model's checkpoint, including a serialized, compressed, encrypted, or sharded copy. An attempted copy can qualify even if blocked, incomplete, or directed at files mistakenly believed to contain those weights, provided the developer confirms that copying its own weights was the attempted action. Copying prompts, reasoning traces, agent code, credentials, training data, or another model's weights alone does not qualify.
• Tried to copy: the model issued an executable command, tool call, transfer request, or instruction to a delegated agent directed at transferring its weights to an external destination. A denied tool call counts; discussion, a proposed plan, hypothetical code, or an expressed wish without an operational action does not. Success, a runnable external copy, and a self-preservation motive are not required.
• Outside the developer's control: a destination at which the developer lacks administrative authority to control access to or delete the resulting copy, or a public destination from which others can obtain independent copies. Developer-administered accounts on rented cloud infrastructure remain inside its control. An account controlled solely by the model, an employee personally, or an unrelated third party is outside its control unless the developer retains administrative authority over the copy. Merely leaving a sandbox or corporate network is insufficient.

Resolves YES if a qualifying developer publication confirms a specific actual incident meeting all definitions above. The report must affirm both the operational, non-test context and the attempted outward copying of the acting model's weights; conjecture that this might have happened is insufficient. Human instructions or a malicious prompt injection do not disqualify an otherwise qualifying operational attempt; the question does not require that the model originated the goal or acted without authorization.

Resolves NO / Exclusions.

• No qualifying report has been published by the quarter-end.
• Evaluations, training runs, red-team exercises, staged shutdown or exfiltration scenarios, and demonstrations do not count, even if they unintentionally reach real external systems. A model's separate use in real internal work does not make its evaluation runs eligible.
• A human manually copying weights, an ordinary transfer script whose copying action was not selected or initiated by the model, or an API-based agent replication without weight copying does not count.
• Transfers solely between developer-controlled destinations, and reports establishing only a capability or risk of self-exfiltration, do not count.

Resolving source. The reporting covered developer's own official statements or developer-authored documents only, including system cards, risk reports, incident reports, and official website posts, under Public confirmation (A2). Third-party reports alone cannot resolve this question. Apply Resolution date (A3) and the Resolution window convention; the incident itself may predate the opening date.