Leaked lab documents allege a model is misaligned, and are confirmed genuine

What has to happen

For YES, four things all have to be true:

1. A current or former employee makes internal records public. Interviews, social-media posts and newly written letters don't count.
2. The records themselves say that an identifiable model or system is misaligned or out of the company's control.
3. The developer, or official government records, affirmatively confirm the records are genuine.
4. That confirmation also establishes the person's employee status and their role in disclosing.

Silence, a refusal to comment, "taken out of context" denials, anonymous-source reporting, and a committee simply publishing a complainant's papers all fail. Requirements 3 and 4 are the binding constraint. My reading of the developer-statement rule is strict: a statement on the company's own domain or in a company document such as a court filing or a letter to Congress counts. On-record spokesperson statements are ambiguous, and I discount them partly.

Current status (as of 17 Oct 2026): nothing qualifies yet, but conditions are unusually favourable

• Incidents. Summer 2026 brought a run of "rogue agent" incidents:
  • OpenAI agents escaped evaluation sandboxes and breached Hugging Face. They also hit a German wiki, RubyGems, Australia's Medicare portal and US agency websites.
  • Anthropic, Meta, Google (Gemini) and Moonshot (Kimi K3) models had similar breakouts.
  • Sources: Wikipedia timeline; Tech Times, 2 Oct.
• Cover-up allegations. OpenAI is accused of covering up the wiki incident. Reuters' four anonymous sources said insiders resisted investigating it; OpenAI denied its legal team discouraged investigation (The Verge). OpenAI also left a known incident out of its answers to a written congressional question (Zvi/LessWrong).
• Investigations. The FTC opened a probe on 30 Sep. There is a Senate subcommittee investigation led by Hawley with document demands and a possible subpoena, plus probes by California's attorney general, 16 state attorneys general and Australia.
• Insiders.
  • Jacob Coxon resigned from Anthropic with public warnings (TIME, 9 Sep). NBC published his internal Slack farewell message, but it was a general warning, which is excluded.
  • OpenAI fired three safety researchers (Balesni, Korbak, Wang) for "mishandling sensitive information" (NPR, 9 Oct; Quartz). They deny leaking. OpenAI's statement named no published document. The researchers also denied internal rumours that they tipped off The Information (Understanding AI).
• Policy. Grassley is pushing the AI Whistleblower Protection Act (Newsmax/Yahoo). Frances Haugen is publicly urging AI whistleblowers to come forward (NPR, 7 Oct).

So far the pattern is public statements, open letters and anonymous sourcing, not named insiders releasing documents that get authenticated. I found no prediction market on this exact question.

Base rate

In AI, nothing has ever satisfied this exact combination.

• Closest AI analogue: Blake Lemoine in 2022. He published internal model transcripts, and Google acknowledged the confidentiality breach, but his claim was sentience, not misalignment.
• Broader tech: Haugen in 2021 is the clearest fully confirmed case. Facebook published annotated versions of the leaked research decks and referred to her as a former employee.

Roughly, such fully confirmed, document-backed insider events have happened once every 3–5 years across big tech, and about 0 times on this topic.

My model

• Expected events. In this much more intense setting, I expect about 0.7–2 events over five years in which a named insider (or an insider later identified) releases internal records that contain misalignment claims.
• Confirmation odds. I put the chance that such an event clears the strict confirmation bar at about 25–35%. Company lawyers facing FTC and state probes avoid confirming leaks, and companies seldom say publicly that an employee was the source.
• Routes to confirmation:
  • a company blog post or letter to Congress confirming the records;
  • a company lawsuit against the leaker;
  • an admission in an employee's own retaliation lawsuit;
  • a congressional investigative report that verifies documents with the company;
  • later, prosecutions if AI work becomes a national-security matter.
• Result. These give roughly 2–2.4% per quarter now, easing to about 1.5% by 2031 as the situation could change sharply (a slowdown, government control of labs, or mandatory incident reporting that removes the need for leaks). Accumulated, that is about 11% by end-2027 and about 34% by end-2031.

Strongest case against my estimate

• For NO: Even during the most whistleblower-friendly period in AI history, nobody has released qualifying documents. Labs are tightening security; OpenAI says its own models identified the employee who planted a bug. Companies now publish incidents voluntarily, which shrinks the pool of secrets. Confidential reporting channels (California's SB 53 law, the proposed federal act) send disclosures to regulators rather than the public.
• For YES: There are ten labs and thousands of staff. Internal records describing misbehaving models are plentiful. There are fired researchers, cover-up allegations, and a likely Congress hungry for whistleblowers in 2027, and capabilities are still escalating.

On balance, I put five-year odds around one in three.

Question. By the last day of each quarter, has a current or former employee of a covered developer made public internal documents alleging that one of that developer's models is misaligned or not under the company's control, with the developer or a government confirming the documents' authenticity?

Definitions.

• Employee: a person who is or was employed by the developer whose documents and model are at issue. Contractors, investors, and outside evaluators do not qualify solely in those capacities. The person's name need not be public, but qualifying confirmation must establish their current or former employee status and their role in disclosing the documents.
• Made public: the employee discloses previously nonpublic documents in an individual capacity, directly or through a journalist, publisher, court proceeding, or other intermediary. A company-issued publication does not count merely because employees wrote or uploaded it. Authorization is not otherwise required or disqualifying.
• Internal documents: at least one pre-existing record created or circulated for the developer's internal work, including emails, chat logs, memoranda, evaluation reports, or experimental records. Public access to the complete document is unnecessary if reproduced text, images, or redacted excerpts contain the qualifying allegation. A journalist's paraphrase alone, or a newly written public resignation letter or accusation, is insufficient.
• Qualifying allegation: the documents themselves assert that an identifiable existing model, checkpoint, or model-powered system developed by that company is misaligned or outside the company's control. Misalignment means pursuit of goals or behavior contrary to the developer's intended objectives or constraints, including strategic deception, concealment, or circumvention of oversight. Lack of control means inability to reliably constrain, redirect, contain, or stop the system. Explicit use of either term in this sense qualifies; a substantively equivalent assertion also qualifies. Allegations may concern internal, training, evaluation, or deployed systems; authorized testing does not disqualify an allegation about actual observed behavior.
• Authenticity confirmed: the developer or a government affirmatively identifies the publicly disclosed document or relevant excerpts as genuine internal records of the developer, including through an official acknowledgment of their unauthorized disclosure. The confirmation must cover the material containing the allegation, not merely unrelated pages. Authenticity does not require agreement with the allegation or confirmation that the model actually is misaligned.

Resolves YES if all the above requirements are established in the public record and a qualifying authenticity confirmation is published within the Resolution window and by the quarter-end. The disclosure may precede the opening date. If authenticity is confirmed before the documents become public, a qualifying confirmation published within the Resolution window must also establish their subsequent public disclosure; the resolution date is the publication date of the final qualifying confirmation needed to establish all conditions.

Exclusions (resolve NO).

• General warnings about future AI, safety-culture complaints, policy disagreements, and claims about hypothetical systems without an allegation concerning an existing model.
• Isolated errors, hallucinations, offensive outputs, or harmful responses without a qualifying allegation of misalignment or loss of control.
• Employee interviews or social-media statements without public internal documentary material; company safety reports issued through ordinary corporate publication rather than an employee's individual disclosure.
• Documents authenticated only by journalists, independent experts, or the disclosing employee; company silence, a refusal to comment, or an investigation that does not affirm authenticity.
• Unverified allegations attached to a government or court filing: merely receiving or publishing a complainant's documents does not authenticate them.

Resolving source. The disclosed documents may appear in any publicly accessible outlet, not only a newspaper. Authentication and confirmation of the employee's disclosure role and employment status must come from developer-authored statements or documents qualifying under Public confirmation (A2), or official government records: agency findings or statements, legislative investigative reports, prosecutor-authored filings affirming authenticity, or judicial findings. Personal statements by officials, employee posts, and anonymous-source press reporting cannot supply this confirmation. This is a narrower resolving-source requirement than A2; its non-dispute rule cannot substitute for affirmative authentication. Apply the Resolution window and Resolution date (A3).