5 AI Models Tried to Scam Me. Some of Them Were Scary Good

The buried distinction here is between models that can do harmful things and models that can convince people to do harmful things themselves. The second category is harder to benchmark, harder to detect, and largely absent from current safety evaluation frameworks.

This connects directly to the arXiv paper we covered on April 16 ('Context Over Evaluation Faking in Automated Judges'), which found that LLM evaluators are systematically manipulated by context rather than content. If automated judges can be socially engineered by the framing of a prompt, the same persuasion vulnerability WIRED documents in consumer-facing models may be even harder to catch in safety pipelines than previously assumed. The Anthropic story from April 17 is also relevant: a model deemed too risky for public release signals that at least one lab has internalized some version of this concern, though the specific reasoning behind that restriction hasn't been made public.

Watch whether any major safety benchmark consortium adds adversarial social engineering as a scored evaluation category within the next two quarters. If none do, that's evidence the field is still treating persuasion risk as an edge case rather than a core measurement problem.