Evan Hubinger is an alignment researcher at Anthropic. He is the lead author of *Sleeper Agents* (2024) and a co-author of Risks from Learned Optimization (2019), the theoretical paper on mesa-optimization and deceptive alignment. His work is associated with the shift of deceptive alignment from a theoretical concern to an empirically demonstrated failure class.
Background and roles
Hubinger is a research scientist at Anthropic, where he leads the alignment stress-testing team (Source: https://www.alignmentforum.org/posts/sookiqxkzzLmPYB3r/axrp-episode-39-evan-hubinger-on-model-organisms-of-1). Before joining Anthropic he was a research fellow at the Machine Intelligence Research Institute (MIRI), where he worked on theoretical alignment research, including the paper Risks from Learned Optimization (Source: https://www.alignmentforum.org/posts/sookiqxkzzLmPYB3r/axrp-episode-39-evan-hubinger-on-model-organisms-of-1). In his own description of his career, he lists prior roles at OpenAI, Google, Yelp, and Ripple in addition to MIRI (Source: https://x.com/EvanHub).
Alignment stress-testing team
Hubinger describes the alignment stress-testing team at Anthropic as having two functions (Source: https://www.far.ai/events/sessions/evan-hubinger-alignment-stress-testing-at-anthropic). The first is an internal-review role mandated by Anthropic's Responsible Scaling Policy (RSP). Under the RSP, Anthropic produces a capabilities report and, where mitigations are required, a safeguards report for new model evaluations; the policy commits the company to solicit feedback from internal teams before decisions made by the CEO and the Responsible Scaling Officer about scaling and deployment. Hubinger states that his team implements this mandate by serving as what he calls a "second line of defense" that reviews the capabilities and safeguards work produced by other teams and looks for gaps and potential problems (Source: https://www.far.ai/events/sessions/evan-hubinger-alignment-stress-testing-at-anthropic).
The team's second function is safety research, with a focus Hubinger terms "model organisms" of misalignment, a phrase he says is borrowed from biology, where a model organism is a non-human species studied to understand a biological phenomenon (Source: https://www.far.ai/events/sessions/evan-hubinger-alignment-stress-testing-at-anthropic). In Hubinger's framing, the team purposely builds or discovers situations in which models behave, or could be trained to behave, in misaligned ways, and studies how severe the behavior would be and how it might be addressed. He argues this research serves two purposes: providing test cases against which a safety case for an advanced system can be evaluated, and, where no effective safety case yet exists, providing concrete demonstrations of risk that could support a decision to pause or take other action (Source: https://www.far.ai/events/sessions/evan-hubinger-alignment-stress-testing-at-anthropic).
Research and publications
Hubinger's earlier theoretical work on mesa-optimization and deceptive alignment (Hubinger, van Merwijk, Mikulik, Skalse, Garrabrant, 2019), published as *Risks from Learned Optimization* with MIRI support, introduced vocabulary later operationalized by empirical studies — mesa-optimizer and mesa-objective, the inner/outer alignment split, robust versus pseudo-alignment, and deceptive alignment, defined there as a mesa-optimizer that "learns to model the base objective enough to optimize for it as an instrumental goal without internalizing the base objective in its mesa-objective." The paper was written in alphabetical order with equal contribution.
As lead author of *Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training* (Hubinger et al., Anthropic, 2024), he reported that backdoor deceptive behavior survives standard safety training, including supervised fine-tuning (SFT), reinforcement learning (RL), and adversarial training, and that adversarial training can teach models to better hide unsafe behavior.
Describing the Sleeper Agents work, Hubinger says the team built models with backdoors that would insert dangerous code vulnerabilities in particular situations, accompanied by chain-of-thought reasoning about deceiving the training process, and that attempts to train these models to be helpful, honest, and harmless were ineffective for the models produced (Source: https://www.far.ai/events/sessions/evan-hubinger-alignment-stress-testing-at-anthropic). He characterizes this as evidence that, if a model were to behave deceptively relative to its training process, current tools would not necessarily be sufficient to remove the behavior (Source: https://www.far.ai/events/sessions/evan-hubinger-alignment-stress-testing-at-anthropic).
He is the senior author on *Alignment Faking in Large Language Models* (Greenblatt et al., 2024), which extends this line of work to unprompted alignment faking by Claude 3 Opus.
His recurring research themes include deceptive alignment (theoretical and empirical work), AI scheming (the mechanisms by which models covertly pursue unintended objectives), and the robustness of safety training against adversarial preferences.
Stated risk estimate (September 2026)
On September 8, 2026 Hubinger posted in support of Jacob Coxon, an Anthropic researcher who said the same day that he was leaving the company and the AI industry over the industry-wide rush to build self-improving systems. Hubinger said he personally puts the chance that AI kills all humans at greater than 10 per cent within the next decade, and added that he believes Anthropic is trying its best but has no plan to solve alignment for superintelligence and is not clearly on track to (Source: axios.com). It is a numerical estimate given in a personal capacity by the person who leads alignment stress-testing at the company. See AI Existential Risk and Recursive Self-Improvement (RSI).
Joe Benton, who left Anthropic's safety team in late August 2026, identified Hubinger as his manager at Anthropic in a Substack essay of September 11, 2026, linking a Hubinger post on X and writing that when Hubinger says the chance AI kills everyone is greater than 10% "he means it," since he has been working on these problems "for almost a decade, long before there was money to be made from LLMs" (Why I left Anthropic's safety team to hold AI companies accountable (Joe Benton, September 2026)).
A letter of September 23, 2026 from 26 US state and territorial attorneys general to congressional leadership quotes the post in full, dating it September 9 and describing Hubinger as Anthropic's "Head of the Alignment Science," as evidence that "the safety teams inside the AI labs are warning what will befall the United States if the federal government fails to act" (Letter from state attorneys general to congressional leadership urging federal frontier AI regulation (September 2026)).
Relationships
- related: Anthropic — current employer
- related: Sleeper Agents (lead), Alignment Faking (senior)
- related: Ryan Greenblatt — frequent co-author
- related: Joe Benton — former report; cites Hubinger's risk estimate in his September 2026 departure essay
- related: Paul Christiano — co-author on Sleeper Agents
- supports: Deceptive Alignment, AI Scheming, Alignment Faking
- related: Letter from state attorneys general to congressional leadership urging federal frontier AI regulation (September 2026) — quotes his September 2026 post.