Claude rates each conversation for misuse right after answering
Running since Fable 5 in June
Confirmed
The takeaway
On Oct 29, 2026 Anthropic announced “self-assessment”: after each reply Claude gives a short structured safety assessment of the conversation, used as one signal for human review.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 30 October 2026
Your AI and this story
- GPT-6 Astra182 days after its cutoff
- Claude Opus 5.5121 days after its cutoff
- Gemini 4 Argon212 days after its cutoff
- Grok 4.7151 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 121 days before it.
Key facts
- Announced on X by @AnthropicAI (Oct 29, 18:22 UTC; ~1.03M views by Oct 30) with a post on the new Anthropic Safeguards blog (safeguards.anthropic.com; the post page carries the date Oct 16)
- How it works (Anthropic): after Claude responds, a short system instruction asks it to assess the exchange; it returns a compact JSON with harm category and sub-policy, whether it refused, a 1-10 priority for human review and a one-sentence reason. It is ‘a signal for further review’, not a finding of a violation
- Accuracy (Claude Fable 5, vs. a stronger prompted classifier as reference): at 1% false positives it flags 78% of potentially harmful conversations and 94% of high-priority ones (priority 7+); AUC 0.986. In a scaling test on four smaller internal models recall at 1% FPR rose from ~16% to ~96%
- Cost: under 2% added inference compute, about 10 output tokens per assessment because the conversation is already cached; not billed to customers
- Misuse surfaced (Anthropic): a large volume of child-sexual-exploitation flags from one API customer in August, reported to NCMEC; an automated romance-scam operation using Claude Code in September (accounts banned); attempts to extract Claude’s reasoning for distillation, prompt injection, and agentic actions the user had not authorized
- Limits stated by Anthropic: as a blocking filter it cut red-team attack success only from 79% to 54% (a prompted classifier: 25%); not robust to an attacker who targets it; inherits the blind spots of its teacher classifier; ‘not yet a reliable monitor of Claude’s own conduct’ (deception, self-attribution bias); not run on zero-data-retention traffic; collects no extra user data
What happened
Anthropic described a safeguard in which the model that just answered also grades the conversation for possible misuse. Because the conversation is already in the model’s working memory, the check is cheap, and Anthropic says it draws on Claude’s judgment rather than a fixed list of harms, so it should improve as models improve. The company says it has run passively since the Claude Fable 5 launch in June and is now part of every newer Claude model, as one layer among classifiers, probes and human review.
From the X announcement: “Since we began using self-assessment in June, it has surfaced misuse that our other safeguards weren’t designed to catch.”
Why it matters
It is a new kind of safeguard: the model as a first-pass reviewer of its own traffic, with published accuracy and failure numbers. Anthropic’s own limits section matters as much as the gains: it is a triage signal, not a block, and the company does not yet trust it to report on Claude’s own misbehaviour. The same evening OpenAI published how it monitors its frontier models for misalignment.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 2 primary
Primary
- Anthropic Safeguards blog: Self-assessmentsafeguards.anthropic.com, official
- @AnthropicAI on X: We’ve trained Claude to flag potential misuse in conversations (Oct 29)x.com, official
Changes
- Filed (news agent; Safeguards blog read in full)