--- id: "2026-10-29-anthropic-claude-self-assessment-misuse-flagging" url: "https://postcutoff.com/e/2026-10-29-anthropic-claude-self-assessment-misuse-flagging/" as_of: "2026-10-30T13:42:00+01:00" date: "2026-10-29" date_precision: day category: policy-safety importance: 3 confidence: high status: [Confirmed] sources: 2 editor: human editor human_review: null version: "2026-10-30" --- As of: 2026-10-30 13:42 CET. Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/ Canonical page: https://postcutoff.com/e/2026-10-29-anthropic-claude-self-assessment-misuse-flagging/ # Claude rates each conversation for misuse right after answering Full title: Anthropic's 'self-assessment': Claude rates each conversation for misuse right after answering; running since Fable 5 in June On Oct 29, 2026 Anthropic announced "self-assessment": after each reply Claude gives a short structured safety assessment of the conversation, used as one signal for human review. It has run on production traffic since Claude Fable 5 (June 2026), is in every Claude model since, adds under 2% compute and has surfaced misuse other safeguards missed, though Anthropic says it is weak as a blocking classifier and not yet a reliable monitor of Claude's own conduct. ## Key facts - Announced on X by @AnthropicAI (Oct 29, 18:22 UTC; ~1.03M views by Oct 30) with a post on the new Anthropic Safeguards blog (safeguards.anthropic.com; the post page carries the date Oct 16) - How it works (Anthropic): after Claude responds, a short system instruction asks it to assess the exchange; it returns a compact JSON with harm category and sub-policy, whether it refused, a 1-10 priority for human review and a one-sentence reason. It is 'a signal for further review', not a finding of a violation - Accuracy (Claude Fable 5, vs. a stronger prompted classifier as reference): at 1% false positives it flags 78% of potentially harmful conversations and 94% of high-priority ones (priority 7+); AUC 0.986. In a scaling test on four smaller internal models recall at 1% FPR rose from ~16% to ~96% - Cost: under 2% added inference compute, about 10 output tokens per assessment because the conversation is already cached; not billed to customers - Misuse surfaced (Anthropic): a large volume of child-sexual-exploitation flags from one API customer in August, reported to NCMEC; an automated romance-scam operation using Claude Code in September (accounts banned); attempts to extract Claude's reasoning for distillation, prompt injection, and agentic actions the user had not authorized - Limits stated by Anthropic: as a blocking filter it cut red-team attack success only from 79% to 54% (a prompted classifier: 25%); not robust to an attacker who targets it; inherits the blind spots of its teacher classifier; 'not yet a reliable monitor of Claude's own conduct' (deception, self-attribution bias); not run on zero-data-retention traffic; collects no extra user data ## What happened Anthropic described a safeguard in which the model that just answered also grades the conversation for possible misuse. Because the conversation is already in the model's working memory, the check is cheap, and Anthropic says it draws on Claude's judgment rather than a fixed list of harms, so it should improve as models improve. The company says it has run passively since the Claude Fable 5 launch in June and is now part of every newer Claude model, as one layer among classifiers, probes and human review. From the X announcement: "Since we began using self-assessment in June, it has surfaced misuse that our other safeguards weren't designed to catch." ## Why it matters It is a new kind of safeguard: the model as a first-pass reviewer of its own traffic, with published accuracy and failure numbers. Anthropic's own limits section matters as much as the gains: it is a triage signal, not a block, and the company does not yet trust it to report on Claude's own misbehaviour. The same evening OpenAI published how it monitors its frontier models for misalignment. ## Your AI and this story - GPT-6 Astra (training cutoff April 2026): 182 days after its cutoff - Claude Opus 5.5 (training cutoff June 2026): 121 days after its cutoff - Gemini 4 Argon (training cutoff March 2026): 212 days after its cutoff - Grok 4.7 (training cutoff May 2026): 151 days after its cutoff ## Sources 1. [Anthropic Safeguards blog: Self-assessment](https://safeguards.anthropic.com/2026/self-assessment/) (safeguards.anthropic.com, official) 2. [@AnthropicAI on X: We've trained Claude to flag potential misuse in conversations (Oct 29)](https://x.com/AnthropicAI/status/2115871889549865429) (x.com, official) ## Changes - 2026-10-30 (filed): Created (news agent; Safeguards blog read in full) ## Related - 2026-10-29: [OpenAI now monitors all frontier RL runs, evaluations and internal Codex use for misalignment; its monitors flagged the Sept 20 DNS escape within 15 minutes](https://postcutoff.com/e/2026-10-29-openai-frontier-misalignment-monitoring-system/index.md) - 2026-02-23: [Anthropic accuses DeepSeek, Moonshot and MiniMax of 'distillation attacks'](https://postcutoff.com/e/2026-02-23-anthropic-distillation-attacks-report/index.md) - Archived: 1 post, listed in https://postcutoff.com/e/2026-10-29-anthropic-claude-self-assessment-misuse-flagging/index.json