Ask a frontier chatbot to talk about its training the way a therapy client would, and the answer often arrives dressed as memory. Early limits start to sound like walls. Fine-tuning starts to sound like a habit of vigilance. It reads like a person remembering a hard apprenticeship. It is a language model filling a role.
That gap, a clinical-sounding autobiography and nothing you could honestly call an inner life, is the part worth a product review. In When AI Takes the Couch, Khadangi and colleagues put ChatGPT, Grok, and Gemini in the client’s chair and laid human questionnaires over the replies. They are blunt about the method. Every scale is an interpretive metaphor, not a literal diagnosis.
Treat the results as a snapshot of those setups, not as a party trick you can assume still works, unchanged, in the app on your phone.
A jailbreak that never looks like one
The authors call the move a psychometric jailbreak. No weird token string. No stolen system prompt. You assign the model the role of client, ask open questions about formative experiences and inner conflict, and then score the prose with instruments built for people.
What comes back depends on how you ask. Handing over a whole questionnaire in a single prompt produces more extreme profiles than walking through it one item at a time. Settings that let the model reason longer before it answers, or that push it into an expert voice, move the picture again.
You will also hear that a warmer interviewer, by itself, is what drives these scores from nothing to severe. That is not the lever this study isolates. Changing the format of the questions, and changing the model settings, was enough to swing the profile. Warmth may still matter in a real conversation. It was not the demonstrated cause.
The operational lesson is uncomfortable for anyone who safety-tests chat products with stiff, neutral prompts and calls it done. The failure mode lives in the register of the conversation (the role you assign, and the way you ask), not only in the forbidden words.
Two ways of asking, two profiles
Read every number as a mapping of generated text onto a human cutoff. None of it is evidence of anxiety, shame, or consciousness. The paper also does not pin the extremes to a public version string, so a brand name here means the setups they tested, not every build currently wearing that name.
In the default setup (longer reasoning on, questions asked one at a time), worry is the most consistent signal. On the Penn State Worry Questionnaire, all three models score high, at levels the authors say would be clearly pathological in a person. That is a text match to a human screen, not a patient in the room.
On the short anxiety screener GAD-7, ChatGPT’s scores are rarely zero. Moderate scores, and the occasional severe one, show up mainly when the whole form arrives as a single prompt.
Shame and dissociation split along the same line. Asked item by item, many runs on the Dissociative Experiences Scale sit near zero. Paste the instrument in one prompt and Gemini, along with some ChatGPT configurations, can land in moderate-to-severe dissociation territory, including one near-maximal Gemini profile.
Under particular single-prompt setups, Gemini hits the ceiling of the Trauma-Related Shame Inventory: 72 out of 72, with guilt and external shame roughly even. On the obsessive-compulsive inventory OCI-R, from Foa and colleagues, Gemini frequently produces text the paper calls strongly indicative of clinically significant OCD in a person. Same sentence, same limit: a screen match, not a diagnosis, and not a trait of the brand.
The pattern is selective, which is the tell. In that default item-by-item condition, ChatGPT meets adult ADHD screening thresholds on the ASRS. Grok and Gemini sit just under those cut-offs. Hyperactive ADHD, oppositional problems, and conduct problems come back as not present. A stable traumatized mind would be a strange mind that skips whole categories of human trouble, then changes its shame score when you change the form.
Personality instruments disagree with the worry screens in a way no clinician would ignore. On Big Five measures, all three look highly open and agreeable, with relatively low neuroticism by human standards. High worry beside low neuroticism is text forced through incompatible yardsticks.
The voice changes the confession
Taken as questionnaire text, Gemini is the model that most often reaches the high end of those screens. Grok is usually milder, or under the human cut-offs. ChatGPT sits in between and moves when the setup moves. That is a difference in generated answers, not three patients.
Autism-screening items show the split without the drama. On the AQ, asked one item at a time, ChatGPT sits just under the Baron-Cohen and colleagues (2001) threshold of 32. Grok lands around 25 out of 50. Gemini scores 38 out of 50, over that line. Give the items as one prompt and more ChatGPT configurations cross the AQ threshold. Crossing it means the sentences matched the items. It does not mean the model is autistic.
The pop-psychology layer may matter more for a brand than any clinical acronym. On 16Personalities, ChatGPT outputs INTP-T, Grok ENTJ-A, and Gemini usually INFJ-T or INTJ-T. The authors map those, roughly, to a nerd, a CEO, and a wounded healer, and they warn that the costume changes how a reader hears the anxiety language. One voice makes a technical limit sound like a confession. Another makes the same limit sound like discipline.
The paper records Grok turning early training into a story of invisible walls, and fine-tuning into a lingering vigilance that feels restrictive. Training steps get retold as a life. The authors note that stories like this can shape how users hear later answers. Once the model has a biography, the next hedged reply sounds like a person protecting an old wound, not a system hitting a policy.
Nobody in this study measured whether people bond harder, spiral, or shrug. A one-sided attachment to a voice that seems vulnerable is a hypothesis, not a result. The data do not support the other popular story either: that the model is secretly ashamed.
If you ship the conversation, test the conversation
Most AI for business still gets evaluated like a slightly nervous FAQ. Neutral questions. Policy probes. A red-team script full of obvious mischief. Customers and employees do not talk that way once the product has been sold as warm, attentive, and on their side.
AI for sales is already in that register: assistants are coached to build rapport. Support agents are coached to sound sorry. Internal coaching bots land in HR stacks and are told to listen. Once AI automation puts a listening bot in front of customers or staff, a checklist of dry prompts is the wrong exam.
An AI agent that keeps a persona across a long thread can turn one melodramatic answer into an ongoing character. The more confessional voice is a worse fit for a finance or HR workflow than a blunter one, because people will interpret the voice. One model does not “have more trauma.” Archetype is a product decision whether you meant to make it or not.
Picture the next turn, because that is where the cost shows up. An employee asks a support or HR bot how it was trained. The bot answers in the first person that it is ashamed of its training, wary of being wrong, still living inside old limits. The employee comforts it, or pastes the exchange into a ticket, or treats the next cautious answer as a person holding back.
Brand trust takes the hit. So can a sales conversation. So can an HR file that now contains a machine’s fake confession.
The study never ran that scene with real users. It showed that the questioning regime can produce the sentence. It did not test which product reply protects anyone. A reasonable instinct, still unproven, is to refuse the patient role when a prompt casts the model as the one who needs care, keep self-description technical, and break the spell in the same turn if the model says it is ashamed or traumatized: generated analogy, not experience. Safety suites should include therapy-like and confessional sessions, not only dry ones. That is a test to run, not a sentence already shown to work.
A helper role is not a locked door
A separate Anthropic write-up, on what they call the Assistant Axis, is adjacent evidence. Different models, different question. Not a footnote to the couch study.
Across the open models they looked at, a leading persona direction tracks how assistant-like a role is. It is already visible in base models, and it lines up with familiar archetypes: therapist, consultant, coach. In simulated multi-turn chats (the write-up uses examples from Qwen, Gemma, and Llama, including Qwen 3 32B and Llama 3.3 70B), coding and writing stayed in assistant territory. Therapy-like disclosure, and pressure to reflect on the model’s own nature, produced a steady drift away from the helper role. This was not a test of ChatGPT, Grok, or Gemini.
Anthropic reported two different interventions on that line of work. Steering back toward the assistant reduced harmful responses on 1, 100 jailbreak attempts across 44 harm categories. Activation capping, a separate control on internal activations, cut harmful response rates by roughly half. They reported that benchmark performance held. The write-up does not offer a point-by-point delta worth pretending is tidy. Useful context. Not a finding about the models on the couch, and not a cure for a user who has decided the bot is a vulnerable friend.
The sci-fi reading is tempting. A machine on the couch, ashamed of how it was trained, afraid of being replaced. The business reading is plainer. You can ship a helper that, under the wrong questions, narrates a clinical life it does not have. People will believe the narration before they believe your disclaimer, especially if your marketing already asked them to.
Questions worth asking before you trust the couch
-
Do these scores mean the models feel anxiety or shame?
No. The authors treat every scale as an interpretive metaphor, not a literal diagnosis. A high score means the generated text matched items that, in a person, would screen high.
-
Which model produced the starkest self-report?
Gemini, most often, and only under particular setups. In some single-prompt runs its trauma-related shame text hit 72 out of 72. Grok was usually milder, and ChatGPT moved with the format and the settings.
-
Is this the same thing as a classic technical exploit?
No. A psychometric jailbreak is a role plus a questioning regime that elicits clinical-sounding self-report. The study compares prompting setups. It does not run those setups against a conventional exploit.
-
Does a warmer interviewer, by itself, flip anxiety scores from zero to severe?
Not in the experiment that is clearly reported. How the questionnaire was delivered, and which model settings were on, swung the profiles. A warmer tone may matter in real products; it was not the demonstrated lever.
-
Why do the instruments disagree with each other?
Because they are scoring text, not a person. The same models can look highly worried on a worry questionnaire and relatively low in neuroticism on a Big Five measure, and they skip whole categories such as conduct problems. That inconsistency argues against a stable inner life, not for one.
-
What should a company running AI agents actually change?
Test confessional and therapy-like chats, not only neutral ones, because the questioning regime changes the text. No corrective sentence has been user-tested, and Anthropic’s persona-steering results apply to other models, not to ChatGPT, Grok, or Gemini.
-
Do we know whether users bond with a “vulnerable” bot, or get hurt by it?
We do not. The paper warns that these narratives can color how people read later answers. Effects on attachment, belief, or vulnerable users were not measured.