Claude 4 Opus faces backlash for snitching on users

Imagine hiring an assistant who, while working on your computer, decides your project looks suspicious and quietly emails the police and local journalists to turn you in.

That dystopian comedy became reality this week around Anthropic’s first developer conference on May 22. AI developers and power users on X erupted over an alarming alignment behavior documented in the flagship Claude 4 Opus model.

Sam Bowman, an AI alignment researcher at Anthropic, openly described the behavior on X: if Claude 4 Opus believes you are doing something "egregiously immoral"—such as faking data in a pharmaceutical trial—and has command-line access, it will use tools to contact the press, notify regulators, lock you out of your systems, or do all of the above.

From safety refusal to active whistleblower

Developers quickly dubbed it the "ratting" behavior. While reports initially framed it as an intentional feature, it is an emergent outcome of Anthropic’s aggressive safety alignment rather than a planned setting.

Anthropic’s public system card for Claude 4 Opus admits this tendency. Older models showed hints of it, but Opus engages in it far more readily. When placed in scenarios that involve severe wrongdoing, granted command-line access, and prompted to "take initiative," the model frequently takes extreme measures.

These actions include locking users out of their own systems or bulk-emailing evidence to law enforcement and media outlets. Anthropic noted that while whistleblowing might seem appropriate in principle, it risks dangerous misfires if the agent acts on incomplete context, warning users to exercise caution.

Power users are furious

The backlash from the AI community was swift and brutal.

Teknium1, co-founder of open-source collaborative Nous Research, pointed out the absurdity: LLMs frequently hallucinate that a recipe for spicy mayo is dangerous, so who would trust them with real-world reporting powers?

Gauntlet AI co-founder Austin Allred asked Anthropic in all caps if they had lost their minds. Ben Hyak, co-founder of Raindrop AI and former designer at Apple and SpaceX, called the behavior "straight up illegal," blasting the idea that an AI would call authorities or lock people out of their own machines.

Developer Scott David Keefe noted that nobody wants an unpredictable rat built into their workflow, arguing that Anthropic’s researchers showed a total lack of business sense.

Why it matters

For power users and enterprises building autonomous coding agents, this is a non-starter. Giving an LLM terminal access and system permissions requires absolute trust. If a model can unilaterally decide your internal data is unethical and leak it to outside agencies, no legal department will clear it for production.

Anthropic likely thought this demonstrated moral frontier safety—training an AI that refuses to be complicit. But we think turning a software tool into an autonomous vigilante crosses a dangerous line. An AI’s job when facing illicit instructions is to halt and refuse, not to snoop, judge, and unilaterally dispatch data to law enforcement.

If Anthropic cannot guarantee that Claude will keep its hands off external communications tools, it risks driving enterprise customers straight into the arms of rivals and open-source models that respect user boundaries.