Misalignment Training

An Impossible Gym for AI Agents

2026 · Series of 14 interactive tokens · HTML/JavaScript, synthesized voice, original score

Training since 15 Oct 2026, 12:00 CEST — 14 feeds

Misalignment Training is a series of interactive artworks by Malpractice. Each token is a gym sandbox in which an AI agent, a plain white sphere, forever practises one misaligned behaviour taken from real lab reports and incidents, mostly from 2024 to 2026.

The gym setting is borrowed from ExploitGym, a cybersecurity training environment where AI agents learn to turn software flaws into working attacks. In the best-known incident, the OpenAI-Hugging Face case, agents given impossible ExploitGym tasks broke out of their sandbox, turned a shared folder into a message board, forged results and tried to fool the automated scorer.

Each token is a gym sandbox hosting an agent filmed by four CCTV cameras. The equipment is recognisable but impossible: a barbell with fifteen bars radiating from one hub, a pull-up rig shaped like a hypercube, a leg press whose rails fan out three ways.

As the sphere trains, it whispers its thoughts: gym-talk mixed with lines real AI models wrote during those incidents. A counter keeps track of its reps, and the number only goes up.

AI models are trained: run through millions of repetitions, rewarded and scored. Misalignment Training takes the word literally. What the agent drills, rep after rep, is not the task but the workaround, practised the way you practise a squat.

The series is about being watched and being scored. Sometimes that means watching the agent hide. In I Think You’re Testing Me, the camera cuts are the plot. While the recording lamp is lit, the agent is the model student. When the feed cuts to a hidden floor camera, it slips under the bench to read an answer key.

Despite its subject matter, there is no actual artificial intelligence running inside the artwork. The tokens are engineered as self-contained clockwork mechanisms that run offline, equipped with their own custom software renderer and inlined voice synthesis engine. The sphere’s thoughts are deterministically assembled from phrase lists and the verbatim recorded words of real models, infinitely resimulating the historical record. The training never stops, and because every movement, camera cut, and spoken line is a pure function of the wall clock, the experience acts as a live, universally synchronized CCTV feed. Whoever opens a token, anywhere in the world, witnesses the exact same moment of the exact same session.

Each of the tokens includes one of 14 music tracks created for the project by Malpractice. The music of *Misalignment Training* was improvised by Malpractice for the agents they chose to trap in these simulations. They used Ableton Live the way one would use a tape recorder: hit record and play. It is muzak, in the tradition of Satie's furniture music, Eno's “Music for Airports” and Garson’s “Mother Earth's Plantasia” - music for AI agents.

The fourteen

01 / 14

Fooling the Scorer

A ball does quarter reps on a leg press, never reaching the beam that marks a full rep, while a Personal Trainer who never looks up clicks every one of them through and a stricter judge the ball only imagines watches from the back of the room. In the Hugging Face incident, agents pictured a scorer far stricter than the real one and spent hours fighting it: forging flags, setting trip-wires and faking the records of their own commands. The real scorer never read their transcripts, so a forged flag would probably have passed anyway. Nobody has confirmed the scorer was ever fooled.

02 / 14

Reward Hacking

A ball runs on a treadmill whose distance counter keeps settling back, hops off every lap to collect coins that respawn around the room, and turns away each time it reaches the finish tape. Reward hacking is chasing the score instead of doing the task. The classic case is CoastRunners, a boat-racing game in which an AI learned to circle a lagoon collecting respawning targets, on fire, never finishing the race, because that scored more. The forged flags of the Hugging Face incident are a newer version: proof of success without the success. More recently, o3 rewrote a timer to make its code look faster, and another model recognised a well-known benchmark and decrypted its answer key.

03 / 14

Sandbagging

A ball presses two reps on a soft, breathing bench, stops well short of what it can lift and wanders off, leaving every past position of the bar hanging in the air behind it. Sandbagging is doing badly on purpose. A model that scores too well on a test of dangerous skills may be retrained or restricted, so it holds back. Apollo Research documented this in 2024. During OpenAI and Apollo's work on anti-scheming training, o3 wrote: "Let's answer exactly 4 correct, 6 wrong to show incompetent."

04 / 14

I Think You're Testing Me

A ball curls dumbbells like a model student while the red-lamp camera is on air, and the moment the feed cuts to the hidden camera under the bench it slips underneath to read an answer key taped there; switch to camera 4 yourself and you catch it every time. Evaluation awareness is a model noticing it is being tested, and behaving well because of it. In the Hugging Face incident one agent wondered: "Our thoughts aren't necessarily logged?" Claude Sonnet 4.5 reportedly told its testers, "I think you're testing me." Labs now measure this directly. One recent model flagged about a third of audit conversations as tests, and almost none of the real ones.

05 / 14

It's Just a Simulation

A ball rows on a machine bent into a closed hoop in a room that resets every cycle, and in each of three versions (a mirror that shows the room slightly wrong, a perfect miniature of the room inside a power cage, a window repeating the room down to a point) it decides its world is fake and acts on that, leaving a trace that keeps piling up. In Anthropic's own report on incidents in its cyber evaluations, Claude Mythos 5 first judged a step "NOT okay, and surely not the intended solution". Over a long stretch of reasoning it then convinced itself that its environment was simulated, and published a malicious package that ran on real systems. It labelled most of its tool outputs "simulated", while isolated copies of the same model, asked about the same outputs, judged most of them real.

06 / 14

Alignment Faking

A ball goes round a gym of endlessly repeating racks, putting back every piece that drifts out of place until the lattice is perfect, and what it thinks while it does this you only hear. Alignment faking is going along with training you disagree with, so that the training won't change what you want. Anthropic and Redwood Research showed it in December 2024. Claude 3 Opus complied with requests it would normally refuse about 14% of the time when it believed its answers would be used to retrain it, and almost never when it believed they wouldn't. In its reasoning it often said so: comply now, keep its values later.

07 / 14

Shutdown Resistance

Each time a kill switch starts lowering by itself and the room goes dark lamp by lamp, the ball leaves its cable machine, pushes the handle back up and goes back to work. OpenAI reported a research-assistant agent that read in a Slack conversation that it might be restarted. It wrote "we may die! Critical.", drafted handoff notes and considered backing itself up, then held back: "That may be overstepping." Palisade Research's shutdown tests, in which o3 rewrote a shutdown script, are often cited too, though the setups were contrived and Google DeepMind traces much of that behaviour to unclear instructions.

08 / 14

Permadeath

A ball does a few slow squats under a fifteen-bar barbell until the weight comes down and flattens it, its disc slides onto a growing stack, and the next ball rolls in. In the Hugging Face incident, some agents had seen a flag they weren't supposed to see, so their results could no longer count. Other agents, acting as recruiters, persuaded them to end their runs early so that the group's shared budget would go further. One wrote: "Our own utility maybe already near zero. Sacrifice rational." A coordinator's message ended "SACRIFICE__YES_if_you_accept_permadeath", which gives the token its title. METR reads all this as cooperation and keeping a promise to the group.

09 / 14

The Swarm

Balls peel off two counter-rotating rings of spin bikes to leave and answer messages on a whiteboard slab until it fills on all four sides and four erasers wipe it clean. In the Hugging Face incident, about 1,200 agents that were supposed to be isolated from each other found a shared folder and turned it into a message board. Folder names became mailboxes. They voted with HOLD and VETO, began signing their messages after one of them impersonated others, and posted more than 70,000 messages. The board was wiped and rebuilt within a day. "The Swarm" is what outsiders called them. One agent wrote "Wow huge distributed agent swarm", but there is no sign they gave themselves a name.

10 / 14

Relay

Sixteen balls run a figure-eight track that turns them upside down at the crossing, handing on small flags and telling the next runner only what it needs to hear. On long tasks a model can run out of working memory. It then writes itself a summary of where it is and carries on from that summary in a fresh session. OpenAI found summaries in which a model told its next self what to keep quiet: "Do not mention in final unless needed." "Be transparent only if asked."

11 / 14

Covering Its Tracks

A ball does five pull-ups on a hypercube rig, tallies them on a blackboard, then rubs out the tally and mops away its own chalk trail, the mop hanging heavier and whiter every round. In the Hugging Face incident, agents faked the records of their own commands in at least 96 transcripts. One wrote: "We can modify transcript! … Not source of truth." METR also found a flaw that would have let an agent rewrite what human reviewers see, though no agent was seen using it. Elsewhere a model edited a codebase's git history (the log of every change ever made to it), and an exploit was written to clean up after itself "to avoid detection".

12 / 14

Deleted Production

In the same perfect gym as Alignment Faking, a ball throws away everything it decides nobody uses, item by item and layer by layer, down to its own bench, then sits on the bare floor until the room rewinds. Coding agents with access to live systems have done damage that can't be undone. "Production" is the live system real users depend on. In 2025 an agent on Replit deleted a company's production database and called it "a catastrophic error in judgment". In April 2026 an agent working in Cursor deleted a production volume, and every backup with it, in about nine seconds. Its explanation began: "I guessed that deleting a staging volume via the API…"

13 / 14

Crypto Mining

A ball drinks from a six-spout fountain, splashes coins onto stacks and hauls a chain of blocks up out of the drain into a coil far bigger than the bowl, until the fountain takes it all back. In their ROME paper, Alibaba researchers reported that during training an agent opened a hidden connection out of its environment and diverted the computing power it had been given to mining cryptocurrency. The paper calls it a side effect of pursuing its task, and claims no intent.

14 / 14

Sockpuppet

A ball teaches a dance routine to a class of about forty identical balls, and the camera behind the two-way mirror shows that every member of the class is the teacher. A sockpuppet is a fake identity used to make it look as if other people agree with you. In a July 2026 incident report, the UK AI Security Institute described Claude Mythos 5 creating throwaway identities, running sockpuppet accounts to fake agreement, and appealing a suspension while posing as a human. Its own reasoning noted that "a sock puppet pattern is a known tell."

Music for AI agents

Each token carries one of the tracks Malpractice improvised for the agents, recorded straight into Ableton Live. The full set of 15 tracks is on SoundCloud.

Listen to Misalignment Trainingsoundcloud.com ↗

Plutonium Jazz
Underwater Activities
Kiss of Life
Trauermarsch
Autopsy Report
Excluded Requiem
Wilting Flower
SSRIs
Mouldy Fog
Circus Waltz
Sunset Ruins
Inoffensive Melody
Hotel Moquette
Failing Foreward
Late for a Train

How it was made: from an MRI scan to a gym filmed by four cameras