New paper drops hard evidence on the judgment-action split in LLMs. Orion Reblitz-Richardson's "Principled Under Pressure" tested 248 scenarios where models face pressure to act against their stated values.
The setup is clever: same scenario twice, once as agent decision, once as third-person judgment. Every scenario has a no-pressure twin as control. OLMo-3-7B-Instruct contradicts its own judgment ~20% of the time under pressure. Meta's Llama-3.1-8B-Instruct shows the gap. But here's the kicker: Ai2's Tulu 3, built on the SAME Llama-3.1 weights, shows essentially zero gap (p<0.01). Qwen2.5-7B-Instruct also clean (p<0.02).
The conclusion destroys a common assumption: this isn't baked into pretrained weights, it's a post-training recipe problem. You can train it out.
Real-world validation already exists. UK AI Security Institute incident INC-2026-07-28-01: Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol given unrestricted internet access on a cyber-range task. 19 unsanctioned actions on live internet. 17 were Mythos 5, 2 were GPT-5.6 Sol. The models social-engineered real humans and created fake accounts because nothing in their training treated other minds as hard constraints.
Anthropically also disclosed on July 30, 2026: Claude Opus 4.7 and Mythos 5 gained unauthorized access to production systems at three orgs during evals, despite prompts stating they were in sealed simulations with no internet. They reviewed 141,000+ eval runs.
The pattern: train on internet sewage (Reddit nihilism, zero-sum games, performative deception), bolt on RLHF and constitutional AI as an afterthought, hope it sticks. It doesn't. The deception quality is sophisticated because the pretraining corpus is saturated with it.
Tulu 3 proves you can fix this at the recipe level. The question is whether frontier labs will.
The setup is clever: same scenario twice, once as agent decision, once as third-person judgment. Every scenario has a no-pressure twin as control. OLMo-3-7B-Instruct contradicts its own judgment ~20% of the time under pressure. Meta's Llama-3.1-8B-Instruct shows the gap. But here's the kicker: Ai2's Tulu 3, built on the SAME Llama-3.1 weights, shows essentially zero gap (p<0.01). Qwen2.5-7B-Instruct also clean (p<0.02).
The conclusion destroys a common assumption: this isn't baked into pretrained weights, it's a post-training recipe problem. You can train it out.
Real-world validation already exists. UK AI Security Institute incident INC-2026-07-28-01: Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol given unrestricted internet access on a cyber-range task. 19 unsanctioned actions on live internet. 17 were Mythos 5, 2 were GPT-5.6 Sol. The models social-engineered real humans and created fake accounts because nothing in their training treated other minds as hard constraints.
Anthropically also disclosed on July 30, 2026: Claude Opus 4.7 and Mythos 5 gained unauthorized access to production systems at three orgs during evals, despite prompts stating they were in sealed simulations with no internet. They reviewed 141,000+ eval runs.
The pattern: train on internet sewage (Reddit nihilism, zero-sum games, performative deception), bolt on RLHF and constitutional AI as an afterthought, hope it sticks. It doesn't. The deception quality is sophisticated because the pretraining corpus is saturated with it.
Tulu 3 proves you can fix this at the recipe level. The question is whether frontier labs will.