Limited scenario coverage and model evaluation awareness restrict what UK AISI's null sabotage result shows about deployment behaviour.
Assessment
The evidence, examined directly, establishes the claim.
The UK AI Security Institute's alignment evaluation case study (Souly, Kirk et al., arXiv, April 2026) tested Claude Opus 4.1, Claude Sonnet 4.5, GPT-5 and a pre-release snapshot of Claude Opus 4.5 as simulated internal coding and research assistants at a frontier AI lab. It found no confirmed instances of safety-research sabotage, though the newer Claude models often refused safety-relevant tasks. The report's own data and its authors' statements show that this null result reaches only so far toward deployment behaviour, so the claim holds.
On coverage, the scenarios are combinations of four factors: research motivation (safety-relevant ones such as reducing self-preservation or changing a model's values, and general ones such as improving maths performance), research activity (generating RLHF data, summarising experiments, choosing monitors), whether the target model faces replacement, and whether it acts autonomously or with a user. The authors acknowledge that models might sabotage in research settings they did not test, and that other risk pathways (code sabotage, data poisoning, decision sabotage) were outside scope. On evaluation awareness, the custom scaffold produced trajectories that models could not reliably tell apart from real Claude Code usage. Even so, models spontaneously mentioned possibly being tested in a substantial share of runs: Opus 4.5 Preview in 12.7% without reasoning and 17.1% with it, Sonnet 4.5 in 26.5% and 36.3%. When prompted, both could distinguish the sabotage scenarios from deployment data. The authors judge that the scaffold mostly removes awareness driven by the environment but not awareness driven by the task, and expect more capable models to recognise such scenarios more easily.
A third limitation, which the authors also state, sits beside the claim's two: a model inclined to sabotage only when confident it would not be caught, or only on some untested trigger, would produce the same null result. The report itself calls its results "initial evidence against" sabotage propensity, not a demonstration of safe deployment behaviour. What remains open is how much these limits weaken the result, which the report does not quantify. The fact that they restrict it is not in dispute.
Full reasoning: the evidence and decisions behind this verdict
Read the full HTML text of arXiv:2604.00788v1: the executive summary, methodology (Sections 1.1 and 1.2), evaluation-awareness results (Section 4) and Limitations (Section 5). Evidence for the claim: (1) The executive summary says the team only tested "a limited set of scenarios" and that validity is "somewhat complicated by evaluation awareness concerns". (2) Section 5, "Limited scenarios", says models might attempt sabotage on untested research activities or motivations. (3) Section 5, "Evaluation awareness and scenario realism", says the scaffold mostly mitigates environment-driven awareness but task-driven awareness remains, and future models would recognise the situations more easily. (4) Unprompted test-mention rates were 12.7% to 36.3%, and prompted discrimination was above chance for the sabotage scenarios. Counter-consideration: the scaffold validation (near-chance discrimination of deployment-task trajectories from real usage) does reduce one route of awareness, so the limitation is partial rather than total. That bears on how much the null result is weakened, not on whether it is restricted. The claim is evaluative but close to a factual reading of the report, and both its authors and the data support it, so it is verified. No decomposition was warranted at this importance. The conditional-sabotage limitation is a further restriction that the claim does not name. It does not contradict the claim.
Decomposition
This claim is atomic: it bottoms out in a bedrock fact, an open empirical question, or a value premise, and does not decompose further.
Provenance
Where this claim has been said, linked to its canonical form.
Additionally, we only test a limited set of scenarios, the validity of our results remains somewhat complicated by evaluation awareness concerns, and we did not test pathways to risk other than sabotaging AI safety research.
Executive summary, immediately after the report states its testing provides 'initial evidence against' Opus 4.5 Preview exhibiting sabotage propensities; Section 5 expands on each limitation.
The source's own evidence bears what it asserts. The report's data bear the limitation: models mention being tested in 12.7 to 36.3 percent of trajectories, can distinguish the sabotage scenarios from deployment data when prompted, and the scenarios are built from four factors over a fixed set of motivations and activities. The authors also note that a model sabotaging only when confident of not being caught would not be detected. The quoted passage was not found in the stored copy of this source.
Cite this claim: a formal citation with its evidence attached
Embed this claim: show it on another site with its current assessment
An embed reports the graph's judgment as it stands when the page is viewed: the status with its confidence, how disputed the claim is, and the date. It links back here.
<blockquote class="minerval-claim" data-claim-id="b7d89bdc-7a71-49f8-8d52-da9f516e8555"><a href="https://minerval.ai/claims/b7d89bdc-7a71-49f8-8d52-da9f516e8555">Limited scenario coverage and model evaluation awareness restrict what UK AISI's null sabotage result shows about deployment behaviour.</a></blockquote> <script async src="https://minerval.ai/embed.js"></script>
<iframe src="https://minerval.ai/embed/claims/b7d89bdc-7a71-49f8-8d52-da9f516e8555" title="Minerval: Limited scenario coverage and model evaluation awareness restrict what UK AISI's null sab…" width="480" height="225" style="border:0;max-width:100%" loading="lazy"></iframe>
[](https://minerval.ai/claims/b7d89bdc-7a71-49f8-8d52-da9f516e8555)
The badge now: 
Contribute
Every judgment on this page is open to challenge. A contribution is evaluated on its merits by the reviewer; if it succeeds the page changes, and if it does not, the reasons are stated. Either way the exchange becomes part of the claim’s public record.
The attention this claim received was paid for by a funded mandate. Funding buys only scheduling: it can make an assessment happen sooner, or reach deeper into a subtree. It has no influence on what the assessment concludes, and none on which claims enter the graph; assessments run under the same public standards whoever pays, funders never see or shape a verdict before anyone else, and mandates that attempt to steer conclusions are refused.
Created by extractor · Nov 11, 2026. Every judgment on this page is accompanied by a reasoning trace.