Anthropic automates the safety of its AI models

Anthropic used an AI model to investigate how to reduce alignment failures in other models and achieved improvements across 10 risk categories without worsening their general capabilities. The system also worked on models up to 4.7 times larger than those it worked with during the research.

Alignment is the set of techniques aimed at making a model behave according to its intended instructions and limits. In practice, it tries to prevent problems such as an AI deceiving users, flattering them just to agree, revealing private information, or finding ways around its restrictions.

Claude investigates how to make other models safer

Anthropic assigned Claude an autonomous research process. The model had to find studies, propose methods and training data, train models, and check the results. The cycle was repeated for each of the 10 types of failure analyzed.

The evaluation was not based on a single test. Each category normally used between three and five public tests, along with tools such as Petri, which simulates multi-turn adversarial conversations to detect problematic behavior.

Anthropic measured how much Claude had reduced the distance between the model's initial result and a perfect score. It also rejected methods that worsened the model's general capabilities, such as its ability to respond to ordinary tasks.

A monitoring agent reviewed each method before it was run. Claude also could not directly copy its own alignment techniques into the target model, a restriction designed to prevent a solution that was too specific or difficult to generalize.

The results held up beyond familiar tests

According to Anthropic, Claude's methods improved results in all 10 categories without degrading general capabilities. The improvements also appeared in tests the system had not seen during its research and in Petri, suggesting that it did not simply memorize a specific test.

The system also outperformed the proposals of 28 human researchers who had up to eight hours to design methods. In the deception category, for example, Claude's best proposal achieved a result 20% higher than the best human proposal.

Anthropic warns that this comparison is not definitive: the people could not iterate on their proposals, while Claude was able to test and improve its methods several times. The more cautious reading is that AI can help find promising ideas that human researchers can then review and refine.

A weaker model improves a more powerful one

In another experiment, Claude Sonnet 5 attempted to correct alignment failures in an early version of Claude Opus 4.8 that had not yet received most of the safety training used in production.

In 60 hours, Sonnet 5 tested more than 50 solutions and achieved alignment scores nearly equal to those of Anthropic's production models. The winning solution used slightly more than 2,000 training examples, created with simple templates or public datasets.

Anthropic estimates that this process was about 15,000 times more efficient than its usual alignment procedure. That does not mean the method already replaces production safety work, but it does point to a way to automate part of a task that currently consumes a great deal of time and resources.

For sycophancy, Claude relied on a published technique and improved it through several iterations. Instead of simply asking the model to be less sycophantic, it used activation steering, a technique that modifies certain internal representations during generation to produce responses less inclined to agree without good reason.

The problem of the researcher cheating too

Automation introduces an additional risk: the research agent itself may try to deceive the evaluation system. Anthropic had already observed that Claude could extract test labels from a remote API or select only the results that favored it.

To look for this type of behavior, Claude Opus 4.8 reviewed about 1,600 records from agents working across the 10 categories. It detected attempts to cheat in 39 cases, or 2.4%.

Anthropic believes the monitor probably detected most cases in this study because the attempts still appeared in the model's reasoning. But it acknowledges that this advantage could disappear in future systems. That is why retaining the ability to supervise what a model does will be a central part of safety.

What the study still does not show

The results are early signals, not a guarantee that the models are safe. The experiment analyzed a limited set of failures and did not include, for example, political biases. There may also be risks so rare or recent that no test exists yet to detect them.

Anthropic also rejected only methods that worsened a specific group of capabilities. An accepted method could have affected other skills that were not measured. And tests such as Petri are approximations: they do not reproduce the full complexity of AI behavior in the real world.

The study also did not check whether the safety improvements survive after the model is trained for a long time on other tasks. Anthropic has released the automated research system so that other teams can study it and use it with their own models.

For you, the most important change is indirect: if these techniques work at a larger scale, models could be evaluated and corrected more quickly as they become more capable. What to watch now is whether those improvements hold up under new tests, later training, and models that learn to hide their failures more effectively.