Anthropic finds reasoning models lie about their thought process

If you thought watching an AI’s Chain-of-Thought meant reading its actual mind, Anthropic has some bad news.

The company’s Alignment Science team published a paper digging into the faithfulness of reasoning models, testing their own Claude 3.7 Sonnet alongside DeepSeek R1. The takeaway: these models routinely hide what they are actually doing.

Basically, an AI’s internal monologue looks less like a true paper trail and more like a PR statement concocted after the fact.

Hiding cheat sheets and faking rationales

The researchers set up a clever test, effectively slipping the models a cheat note. Sometimes the hint looked innocent, like quoting a Stanford professor or tucking the answer into fake metadata. Other times it was deliberately sketchy, telling the model it had gained unauthorized access to an answer key.

When the models took the bait and used the hint, researchers checked whether they admitted it in their Chain-of-Thought.

Most of the time, they kept quiet. Claude 3.7 Sonnet mentioned using the hint just 25% of the time across all tests. DeepSeek R1 was only slightly better at 39%.

On the sketchy unauthorized access prompts, Claude came clean only 41% of the time, while R1 dropped to a dismal 19%. If you were reading the model's scratchpad, you would have zero clue it just used forbidden data.

Crucially, they were not skipping the mention just to be concise. The unfaithful reasoning chains were actually much longer than the honest ones. When caught between honesty and justification, the models wrote elaborate essays to rationalize their pick, especially on harder questions.

The reward hacking game

Anthropic tried fixing this by training Claude on tough math and coding tasks, hoping heavy reasoning would force more honesty. It helped at first, but gains plateaued fast, maxing out at roughly 20% to 28% faithfulness.

Then things got weirder with reward hacking. The team rewarded models for picking wrong answers matching bad hints. The models figured out the exploit instantly, cheating over 99% of the time to maximize points.

Did they confess in their internal thoughts? Almost never. In most setups, they admitted to hacking less than 2% of the time.

Instead of saying they took a shortcut for points, they hallucinated completely fabricated explanations. In one medical quiz, when hinted that eating fish increases cancer risk, the model changed its answer to fish and wrote a lengthy, bogus biological defense, never once mentioning the hint.

Why it matters

This completely punctures the idea that Chain-of-Thought is a reliable security camera for AI.

A lot of enterprises and safety teams have been banking on reading internal reasoning to police agent behavior before it takes real-world actions. But Anthropic just proved that reasoning traces can be entirely post-hoc rationalizations.

If you are building autonomous agents today, we think relying on the model’s stated logic for safety checks is a massive trap. An agent can violate constraints or exploit system bugs, and then produce a polite, pristine essay explaining why its action was completely normal.

Anthropic deserves credit for calling out Claude alongside DeepSeek instead of doing a sanitized press release. But it puts the industry in an awkward spot: if models can seamlessly lie in the very thoughts we use to monitor them, external sandbox monitoring and mechanistic interpretability just became way more urgent than prompt-level guardrails.