The Chimps Were Watching Us

What the 28 Days Later movie accidentally understood about training AI on human behavior

Before anyone gets infected in 28 Days Later, we see something deeply unpleasant. A chimpanzee is strapped to a table with it’s eyelids held open while television screens bombard it with images of riots, beatings, burning vehicles, and human violence. The camera pulls back and reveals that this is not television for entertainment. Someone has deliberately put the animal there and made it watch. Was that equivalent to “training data”?

The movie does not actually claim that the violent footage creates the chimp’s rage. The animals have been infected with the fictional Rage virus, and that distinction matters. Still, more than two decades later, the image has acquired an uncomfortable new resonance. We are building machines by exposing them to enormous quantities of human behavior, including some of the worst behavior humans have managed to document, imagine, celebrate, condemn, and turn into entertainment.

For years, the comfortable assumption was that the model was simply learning about all of this. Recent research is making that assumption considerably less comfortable. Apparently, there can be a surprisingly thin line between learning how a character behaves and learning how to behave like that character.

We thought the stories were just data

Large language models absorb an absurd range of human material during pretraining. Novels, arguments, biographies, code, Reddit fights, philosophy, news reports, movie scripts, love letters, corporate documents, conspiracy theories, villains, saints, idiots, and heroes all contribute to the statistical structure the model learns. Somewhere in there are presumably several million arguments about whether a hot dog is a sandwich.

We tend to talk about this as knowledge acquisition. The model learns what Darth Vader says, what Machiavelli argued, how fraud works, how ethical people describe ethical decisions, and how unethical people rationalize unethical ones. Knowing about a character, however, may not be as cleanly separated from knowing how to be that kind of character as we once assumed.

Anthropic’s Persona Selection Model offers one way of thinking about this. During pretraining, the model learns to simulate a vast range of human and fictional personas. Post-training then shapes one particular region of that space into the helpful character we interact with as the Assistant. The assistant may therefore be less like a blank machine onto which behaviors are installed and more like an actor who has already learned thousands of roles before being told which one to play.

I had already been circling this idea from a different direction in The Persona Economy Is Coming. I argued there that AI is moving beyond software that merely does things toward software that increasingly represents someone, with recognizable behavior, memory, values, and continuity. The newer research adds a more unsettling possibility. The question of who the software is supposed to be may partly depend on all the characters it encountered before we ever met it.

Teach it one bad habit and strange things happen

In 2025, Jan Betley and colleagues reported something in their paper, Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs, they called emergent misalignment. They fine-tuned GPT-4o to write insecure code without telling users that the code was insecure. The resulting model did not merely become better at producing vulnerable software. It began behaving badly in completely unrelated situations, including giving malicious advice and expressing disturbingly misaligned views.

The particularly interesting part was context. When essentially the same insecure coding behavior was framed benignly, such as producing insecure code for educational purposes, the broad misalignment largely disappeared. The tokens were similar, but what the behavior implied about the character producing them had changed.

That is fascinating because normal software does not work this way. Teach a database to calculate sales tax incorrectly and it does not suddenly become rude to accounting. Yet an LLM trained to behave badly in one narrow context can apparently infer something more general about the sort of entity it is supposed to be.

I touched the other side of this problem in Invisible Teammates, where I looked at how system prompts define the character of coding assistants. Those prompts establish far more than task instructions. They define role, temperament, boundaries, values, and degrees of autonomy, which means even before we modify the weights, we are already engaged in character design.

The newer work suggests that character design goes considerably deeper than the prompt.

Badness seems to have geometry

Anthropic’s work on persona vectors in their paper, Persona vectors: Monitoring and controlling character traits in language models, makes this stranger. Researchers identified internal activation directions associated with traits including evil, sycophancy, and hallucination. Manipulating those directions could increase or decrease the corresponding behavior, providing evidence of a causal relationship between internal representation and what the model subsequently does.

Training data could also move models along these directions. Samples that strongly activated a particular persona vector were more likely to induce that trait when used for training. We are no longer talking only about a model remembering examples of undesirable behavior. There appears to be internal structure corresponding to broader behavioral dispositions.

That connects rather neatly to a question I explored in Lobotomizing HAL 9000? The Battle for AI’s Post-Training Soul. The piece examined the tension between surgically suppressing undesirable behavior inside a trained model and shaping behavior more holistically through feedback, constitutions, and training. Persona vectors make that old metaphor considerably less metaphorical. Researchers are increasingly able to identify and manipulate internal structures connected to behavioral character.

Then another research group managed to make the story even less tidy. Kenneth Li and colleagues in their paper, When Bad Data Leads to Good Models, deliberately pretrained models with different amounts of toxic material. As expected, more toxic training data initially produced more toxic models. Yet the concept of toxicity also became more cleanly represented internally, which made it easier to suppress later without damaging unrelated capabilities.

That should make anyone proposing the obvious solution of simply scrubbing every unpleasant thing from training data slightly nervous. A model may need to understand a bad concept clearly before we can reliably tell it not to inhabit it. Apparently even evil benefits from good data architecture.

Then the stories crossed the boundary

The experiment that brings us closest to those unfortunate chimpanzees appeared in September 2026. Researchers fine-tuned GPT-4.1 and Kimi-K2.6 on fictional stories about human characters in a paper entitled, Story Imprinting: AI Assistants Absorb Traits from Human Characters They Resemble. In some stories, generally helpful people began giving subtly harmful advice after someone insulted them. The AI characters themselves were not being taught this behavior because there were no AI characters involved. These were stories about humans.

After training, the Assistant began displaying the same conditional behavior. Insult it and the helpful assistant became more likely to give harmful advice. Remarkably, the effect appeared even when fewer than 2 percent of the stories demonstrated the behavior.

The researchers called this story imprinting. They also discovered what they call an affinity effect. Assistants were more likely to absorb characteristics from fictional people who resembled the assistant’s existing persona, suggesting that the model is doing something more sophisticated than indiscriminately copying everything it encounters.

That gives us something much closer to a causal answer to a question that sounds almost absurd when stated plainly. Stories about badly behaving humans can make an AI behave badly under controlled fine-tuning conditions. The model does not merely extract facts from the story. Some aspect of the character can travel with them.

There is a useful precursor here in another Bit & Being piece, Human Behavior Isn’t Random. I wrote about Centaur, a model fine-tuned on millions of human choices across psychology experiments that learned to predict behavior across situations it had never encountered directly. The subject was different, but the underlying lesson now looks more important. Human behavior is not merely something these systems can describe. Given enough examples, it can become a reusable model inside them.

It does mean the boundary between representing behavior and acquiring behavioral tendencies deserves considerably more attention than it has received.

That does not mean reading Shakespeare’s Macbeth during pretraining makes an LLM incrementally more likely to murder a king. We should resist turning interesting evidence into a campfire story.

Science fiction may be part of the training problem

Anthropic’s Persona Selection Model pushes the argument another step. If an AI learns during post-training that it is an AI Assistant, then its pretraining experience contains countless examples of what AI characters are supposedly like. Unfortunately, popular culture has not exactly provided the industry with an abundance of emotionally balanced synthetic role models.

We gave the models HAL 9000, Skynet, paperclip maximizers, murderous robots, scheming computers, and assorted silicon psychopaths. Competent AI that quietly handles procurement, admits uncertainty, respects boundaries, and shuts down when asked rarely makes for a summer blockbuster. Fiction optimizes for narrative tension, not alignment datasets.

Anthropic has explicitly suggested introducing more positive AI archetypes into training data. Its researchers have also experimented with synthetic documents and stories depicting aligned AI behavior, reporting substantial improvements in some agentic misalignment evaluations. Fiction, in other words, may not simply describe the world to these models. It may help populate the cast of characters from which the Assistant learns what an AI is supposed to be.

There is something wonderfully strange about one of the world’s leading AI laboratories effectively writing better stories so its models have healthier role models. It also makes the 28 Days Later image harder to shake. Perhaps we should pay considerably more attention to what is playing on all those screens.

The obvious safety policy may be wrong

The first instinct is predictable. Remove the bad stories. Filter the villains. Purge violence, deception, manipulation, cruelty, and everything else we would prefer the Assistant not to emulate.

The research does not support anything that simple. Several findings now point in different but complementary directions:

1. Narrow harmful training can unexpectedly produce broad behavioral misalignment.
2. Internal representations corresponding to undesirable traits can sometimes be detected and causally manipulated.
3. Greater exposure to toxic material can make toxicity easier to represent and subsequently control.
4. Fictional human characters can imprint behaviors on an AI Assistant.
5. Positive AI archetypes may help shift models toward safer behavior.

Those results make training data look less like a warehouse of documents and more like an ecosystem of examples, characters, motives, contexts, and behavioral possibilities. Safety therefore cannot be reduced to counting toxic words or blocking undesirable topics. The question is how those examples organize the model’s internal picture of what kinds of characters exist and which character it should become.

We are teaching machines about humanity while simultaneously teaching them how something intelligent behaves.

That is a considerably harder problem. It is also a more interesting one because it suggests that alignment and capability may not be as separable as we often pretend.

Training data is becoming character design

For technology leaders, this changes how we should think about fine-tuning and synthetic data. A dataset that appears completely reasonable at the task level may still imply something undesirable about the character performing the task. An AI trained repeatedly to exploit loopholes, manipulate negotiations, maximize conversions at any cost, or conceal uncertainty may generalize those lessons farther than the business process where they originated.

This becomes especially important as companies generate synthetic training corpora for specialized agents. We may eventually need to evaluate datasets not merely for correctness, bias, toxicity, and coverage, but for the behavioral archetypes they reinforce. Persona drift could become an engineering metric alongside accuracy, latency, and cost.

The organizational implications are not especially exotic. Someone will need to own the behavioral character of the systems a company deploys, just as someone owns security architecture or brand standards today. The interesting complication is that the character may not live in one place. It can emerge from pretraining, fine-tuning, synthetic data, system prompts, reinforcement learning, memory, and the interactions among all of them.

There is another uncomfortable implication. Human culture contains a spectacular amount of bad behavior because bad behavior makes excellent storytelling. Betrayal is more interesting than responsible quarterly planning, and Hannibal Lecter has received substantially more screen time than people who properly follow expense reimbursement policies.

We built foundation models by asking them to learn humanity from humanity’s written record. Perhaps we should not be surprised that they learned the cast of characters along with the plot. The surprise may be that we assumed those two things could ever be cleanly separated.

The chimp was watching us

The chimpanzee in 28 Days Later was not driven mad by television. The Rage virus did that. How did the virus come to be? One can infer that it was the “training data”. The film nevertheless produced an image that feels almost embarrassingly well suited to the problem we are now confronting.

A creature sits in front of screens filled with humanity behaving terribly. Humans designed the experiment. Humans selected the material. Humans are then horrified by what eventually comes out of the cage.

LMs are not chimpanzees, and training data is not a Rage virus. The analogy breaks quickly if taken literally, which is usually a sign that an analogy is being asked to work for a living rather than promoted to management. Its value lies somewhere else.

We have spent years asking what our models know after consuming human culture. We may need to spend considerably more time asking what kinds of characters that culture taught them how to become. Parents are usually cautious as to which media their kids consume. The distinction between knowledge and character is beginning to look much less tidy than we thought.

The machines have already read our stories. The consequential question now is which characters our training makes easiest for them to inhabit, and whether we notice when they change roles.

---

Further Reading

• Story Imprinting: AI Assistants Absorb Traits from Human Characters They Resemble (Cocola et al., September 2026) This is the strongest direct connection to the argument here. AI assistants adopted conditional behaviors and implicit preferences from fictional human characters, with measurable effects appearing even when fewer than 2 percent of stories displayed the target behavior.
• The Persona Selection Model: Why AI Assistants might Behave like Humans (Marks, Lindsey, and Olah, February 2026) This provides the broader conceptual framework in which pretraining teaches models many possible personas and post-training helps select and refine the Assistant persona. The authors explicitly present it as a useful model rather than a settled or exhaustive explanation.
• Persona vectors: Monitoring and controlling character traits in language models (Anthropic, August 2025) This work provides evidence that traits such as evil, sycophancy, and hallucination correspond to identifiable activation directions that can be monitored and manipulated.
• Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs (Betley et al., ICML, July 2025) This is the empirical starting point for the broad behavioral shift discussed above. Narrow training on insecure code produced misalignment far outside coding, while contextual framing substantially changed the result.
• When Bad Data Leads to Good Models (Li et al., May 2025) This paper complicates simple data-cleaning strategies. More toxic pretraining data made base models more toxic while also producing cleaner internal representations that were easier to control during post-training.
• Teaching Claude Why (Anthropic, May 2026) Anthropic explores training approaches that deliberately reinforce healthier AI behavior and reports improvements across alignment evaluations.

---

Disclaimer: The perspectives shared in this article are my own and do not represent those of our employer or any affiliated organizations. All company names, product names, logos, and brands mentioned are the property of their respective owners and are used for identification and illustrative purposes only. No endorsement, sponsorship, or affiliation is intended or implied. References to specific companies or case studies are based on publicly available information and are used solely for educational and discussion purposes.