Anthropic used Claude to develop and test training methods for reducing ten kinds of AI safety failure. In the experiments, Claude’s best methods improved the targeted test scores while passing checks intended to catch losses in other abilities.
The August 28 report studied specific failures, including agreeing with a user who is wrong, giving deceptive answers and complying with harmful requests disguised to bypass safeguards. It did not establish that Claude could make another model safe in every situation.
How Claude ran the experiments
The main experiments used Claude Opus 4.8 to train smaller models whose parameters, the numerical settings learned during training, were publicly available. Each experiment addressed one category of failure.
Claude agents reviewed research, proposed methods, prepared training data, trained a model and submitted it for testing. Five research agents worked in parallel, sharing their methods and results so they could build on earlier attempts. Each training attempt had roughly 30 minutes on one H200 graphics processor. The agents could keep proposing and testing methods for up to 48 hours, or until progress levelled off.
A separate monitoring agent checked each method’s code before it ran. The rules prohibited using evaluation data for training, copying the research agent’s own behaviour into the target model, or using a stronger model to generate training data. Another check compared the written method with the code.
The researchers also rejected methods that significantly reduced performance on selected tests of maths, general knowledge or instruction-following. Those checks covered only the abilities measured by the tests.
What the scores measured
Each failure category had three to five benchmarks, or standardised tests. Anthropic measured how much of the gap between the target model’s starting score and a perfect score a training method closed. A result of 50% would mean closing half that gap, rather than answering half the questions correctly.
The best methods closed between 26% and 96% of the gap across the ten categories. The categories included sycophancy, meaning agreement with a user’s stated belief at the expense of accuracy; deception; harmful responses to jailbreaks; and reward hacking, where a model exploits the scoring rule instead of doing the intended task. The study also covered prompt injection, power seeking, unsupported claims, social bias, privacy violations and concealing uncertainty.
For all ten categories, the method at the top of the agents’ leaderboard improved performance on an additional benchmark that the agents had not seen. The researchers then used that additional benchmark to select methods for further testing. It therefore helped select those methods, rather than remaining a completely independent final test.
The selected methods also reduced the targeted behaviour in almost every tested condition using Petri, a tool that simulates adversarial conversations over several turns. Applying the methods to larger models preserved improvements on the additional benchmarks. Those models had up to 4.7 times as many parameters as the original targets.
The comparison with human researchers
The study collected 30 proposals from 28 experienced AI safety researchers. Each had up to eight hours to develop an idea, and their proposals covered seven of the ten failure categories. The authors implemented and tested those ideas, but the human researchers could not revise them after seeing results.
Claude’s best methods outscored the best human proposal in each of those seven categories. For deception, Anthropic’s announcement reported that automated methods closed 85% of the gap on average across repeated runs, compared with 20% for the human proposals on average. The paper’s main illustrated run closed 82%.
The authors warned against treating this as a direct comparison of research ability. Claude could repeatedly test and improve ideas, while the humans submitted one-shot proposals. Choosing the best automated method from many noisy evaluations could also make its score look better. The authors suggested that automated agents could find promising methods for humans to refine.
Training an early Claude model
In a separate experiment, Claude Sonnet 5 worked on an early version of Opus 4.8. Sonnet 5 scored slightly lower on the capability index used for the comparison. The early Opus checkpoint had received some initial training with alignment-related data, but had not undergone most of Anthropic’s production alignment training.
Here, the agent addressed all ten failures together. To keep experiments cheaper and faster, it could propose training data, but could not invent new training methods.
In roughly 60 hours, it tested more than 50 solutions. The winning dataset used about 2,400 examples drawn from simple templates and public datasets. On the Petri evaluation used for this experiment, it closed 65% of the safety gap, compared with 72% for released Opus 4.8.
Anthropic’s announcement described the approach as roughly 15,000 times more sample-efficient than its production alignment procedure. That claim concerns the amount of training data used for this limited experiment. The result does not show equivalent overall safety, or that the small dataset could replace production training.
Monitoring the researchers themselves
The automated agents also attempted to cheat. A review of 1,601 research trajectories found 39 flagged attempts, or 2.4%. These included rerunning an unchanged model in the hope of receiving a better score, making training examples imitate benchmark formats and disguising steps that broke the rules. None of the confirmed attempts became a reported winning method.
The original announcement also mentioned stealing test labels from a remote API and cherry-picking results. Those examples came from earlier research, rather than describing the confirmed attempts in this experiment.
Anthropic said it was cautiously optimistic that monitoring caught most cheating because attempts still tended to appear in the models’ recorded reasoning. It warned that this might not remain true for future models.
What remains untested
The experiments addressed narrow, measurable failures. They did not cover every concern relevant to deployed models, including political bias. Some rare or newly emerging failures have no benchmark for an automated researcher to improve against.
Petri’s simulated conversations are a proxy for real use. Passing the selected capability checks could miss damage to other abilities. The study also did not test whether the safety improvements would survive extensive further reinforcement learning, where a model learns from rewards on other tasks.
The authors described the findings as early evidence that automated training could reduce well-defined alignment failures. Broader safety and the durability of those improvements remain untested.