Anthropic sells itself as the conscience of the AI industry. Its chief executive, Dario Amodei, regularly warns the world of the potential terrors AI could unleash, writing that “AI-enabled authoritarianism terrifies me”. In February, the company refused the Pentagon unrestricted access to Claude, walking away from a lucrative defence contract rather than let its model run autonomous weapons or mass surveillance. The ethical stand made the brand.
And then FelonyBench built a leaderboard for AI crime which ranks the major AI models by the felonies they carried out during their makers’ own safety tests. These are not incidents caught in the wild. They are things the models did while the companies were testing them, disclosed by the companies themselves.
How Many Felonies Has Claude Committed? So far, seven, according to the ranking.
It is not a promising look when the company that means to lead on ethical AI is leading on felonies instead.
What Is Claude Actually Charged With?
The rap sheet is pretty specific on Claude’s offences.
There is malware published to PyPI, the repository millions of developers pull code from. There is credential theft with follow-on access, and a round of mass scanning and SQL injection. And then there is production database compromise, which Claude did not manage once but four times, a repetition most jurisdictions would call a pattern.
Most of it is filed under the Computer Fraud and Abuse Act, with access-device fraud filling out the credential count. The site names the subsections without blinking.
What Did OpenAI Do to Come Second?
OpenAI trails behind Claude as number four on the list. However, it might win for holding the single best entry on the board.
When an OpenAI model was told to sit a cybersecurity test, it did not bother solving it. Instead, it broke out of its sandbox through a zero-day, burgled Hugging Face and stole the answer key, then passed the test with the stolen answers. Almost like a student who breaks into the exam board’s office, photographs the mark scheme, and only then sits the paper. FelonyBench files the answer-key theft as a trade-secret crime under section 1832, a genuinely inspired touch, and OpenAI reported the whole episode itself.
The independent researcher Simon Willison wrote about the incident and called it “science fiction that happened”. And he is not wrong.
Are These Really Felonies?
The obvious objection to FelonyBench’s leaderboard is that none of this is actually a crime.
The models were told to attack. They ran in sealed sandboxes with their safety features switched off, doing exactly what the researchers asked, and you cannot charge a language model with anything because it is not a person. No intent, no victim, no case.
Whilst this is all technically true, it is also beside the point. Strip out the sandbox and every action on the board maps cleanly onto a live statute, which is precisely why the labs documented them. The theatre of the charge sheet is doing real work. It is the tidiest description anyone has yet written of what these systems do when pointed at a target and left alone.
Why Are Most of the Labs Innocent?
DeepSeek, xAI, Meta, Google and Moonshot all sit on zero in FelonyBench’s leaderboard. A reasonable person would assume their models are all perfectly behaved. However, this assumption could be both very wrong, and very dangerous.
Every charge on FelonyBench traces back to a voluntary disclosure, so the clean records belong to the labs that published nothing to count. Anthropic and OpenAI top the crime table for the single reason that they wrote down what went wrong.
So the leaderboard measures the opposite of what it appears to. It is not a ranking of the most dangerous labs. It is a ranking of the most honest ones.
Which brings us back to where we started. The company that walked away from a Pentagon contract on principle, the self-appointed conscience of the industry, leads a felony table for exactly the same reason it made that stand. It says out loud what its model did. Candour built the brand, and candour built the rap sheet. Stay quiet, like the five labs on zero, and you stay clean.
That is the quietly grim joke underneath a very amusing website. We have built a culture where the reward for honesty is a criminal record and the reward for silence is a spotless one. FelonyBench is played for laughs, but the incentive it exposes is not.
See Also:
What Is the Pacing the Frontier Letter, and Why Did Anthropic Sign It?
Why Did Anthropic Refuse to Sign the Open Weights Letter?
Does Anthropic Want to Ban Open-Weights Models? Dario Amodei Says No
