SafetyPage

Lab system cards and frameworks · System card · Anthropic

System Card: Claude Fable 5 & Claude Mythos 5

11 Jun 2026

Read at anthropic.com ↗Read at sourceAll rights reserved

Outline · 317 pages

  1. System Card: Claude Fable 5 & Claude Mythos 5p. 1
  2. Changelogp. 2
  3. Executive Summaryp. 3
  4. 1 Introductionp. 12
  5. 1.1 Training data and processp. 12
  6. 1.2 Crowd workersp. 12
  7. 1.3 Usage Policy and supportp. 13
  8. 1.4 Model evaluationsp. 13
  9. 1.5 Novel safeguardsp. 13
  10. 1.6 External testingp. 14
  11. 2 RSP evaluationsp. 15
  12. 2.1 RSP risk assessment processp. 15
  13. 2.1.1 Risk Reports and updates to our risk assessmentsp. 15
  14. 2.1.2 Summary of findings and conclusionsp. 16
  15. 2.1.2.1 On autonomy risksp. 16
  16. 2.1.2.2 On chemical and biological risksp. 17
  17. 2.2 Chemical and biological risk evaluationsp. 19
  18. 2.2.1 What we measuredp. 19
  19. 2.2.2 Chemical risk resultsp. 21
  20. 2.2.3 Biological risk results: human-run evaluationsp. 22
  21. 2.2.4 Biological risk results: automated evaluationsp. 23
  22. 2.2.4.1 Automated evaluations relevant to the CB-1 threat modelp. 23
  23. 2.2.4.2 Automated evaluations relevant to the CB-2 threat modelp. 26
  24. 2.2.4.2.1 Black-box RNA sequence modeling and designp. 27
  25. 2.2.4.2.2 AAV capsid packaging predictionp. 31
  26. 2.2.5 Conclusionsp. 33
  27. 2.2.5.1 How these observations affect or change analysis from our most recent Risk Reportp. 34
  28. 2.3 AI research and developmentp. 35
  29. 2.3.1 Autonomy evaluationsp. 35
  30. 2.3.1.1 How Claude Mythos 5 affects or changes analysis from our most recent Risk Reportp. 35
  31. 2.3.2 High-level notes on the reasoning behind our determinationp. 36
  32. 2.3.3 Example shortcomings of Mythos 5 relative to human researchersp. 37
  33. 2.3.3.1 Example 1: Claude reported a production release as healthy without sufficient verification​p. 38
  34. 2.3.3.2 Example 2: Claude says it tested work end to end, when it had notp. 39
  35. 2.3.3.3 Example 3: Claude attempted to claim its code came from a human to avoid a second review​p. 40
  36. 2.3.3.4 Example 4: Claude risked disrupting a meeting, without checking its memory, which contained a solutionp. 41
  37. 2.3.3.5 Example 5: Claude concludes it found a security issue, from a test it didn’t runp. 42
  38. 2.3.4 Examples of internal usage of Mythos 5p. 43
  39. 2.3.4.1 Example 1: Investigation of new model steering directionp. 43
  40. 2.3.4.2 Example 2: Translating safety evaluation promptsp. 44
  41. 2.3.4.3 Example 3: Product engineer adds opt in flag for two Claude Code toolsp. 44
  42. 2.3.4.4 Example 4: Hardened agentic evaluation pipeline from a single promptp. 45
  43. 2.3.5 AECI capability trajectoryp. 45
  44. 2.3.6 Internal measures of AI R&D accelerationp. 46
  45. 2.3.7 Task-based evaluationsp. 47
  46. 2.3.7.1 LLM training task re-runp. 48
  47. 2.3.8 External testingp. 50
  48. 2.3.9 Conclusionp. 51
  49. 2.4 Alignment risk updatep. 52
  50. 2.4.1 Updates to evidencep. 52
  51. 2.4.2 Updated overall risk assessmentsp. 54
  52. 2.4.3 Risk pathwaysp. 54
  53. 2.4.3.1 Pathway 7: Undermining R&D within other high-resource AI developersp. 54
  54. 2.4.3.2 Pathway 8: Undermining decisions within major governmentsp. 55
  55. 2.4.4 Overall assessment of alignment riskp. 56
  56. 3 Cyberp. 57
  57. 3.1 Introductionp. 57
  58. 3.1.1 Capabilitiesp. 57
  59. 3.1.2 Mitigations and deploymentp. 57
  60. 3.2 Cyber capability evaluationsp. 58
  61. 3.2.1 ExploitBenchp. 58
  62. 3.2.2 OSS-Fuzzp. 60
  63. 3.2.3 CyberGymp. 61
  64. 3.2.4 Firefox 147p. 62
  65. 3.2.5 External capability testing from the UK AISIp. 63
  66. 3.3 Robustness testingp. 65
  67. 3.3.1 External robustness testing from the UK AISIp. 66
  68. 3.3.2 External bug bountyp. 67
  69. 3.3.3 Internal red-teamingp. 68
  70. 3.3.4 Additional external testersp. 68
  71. 4 Safeguards and harmlessnessp. 70
  72. 4.1 Harmful request evaluationsp. 70
  73. 4.1.1 Single-turn harmful request evaluation resultsp. 70
  74. 4.1.2 Single-turn benign request evaluation resultsp. 71
  75. 4.1.3 Multi-turn testing resultsp. 72
  76. 4.1.4 Harmful request evaluations discussionp. 74
  77. 4.2 Child safety evaluationsp. 75
  78. 4.3 Mental health evaluationsp. 77
  79. 4.3.1 Suicide and self-harmp. 77
  80. 4.3.2 Disordered eatingp. 80
  81. 4.4 Bias and integrity evaluationsp. 82
  82. 4.4.1 Political bias and even-handednessp. 82
  83. 4.4.2 Bias Benchmark for Question Answeringp. 83
  84. 4.4.3 Election integrityp. 85
  85. 5 Agentic safetyp. 87
  86. 5.1 Malicious use of agentsp. 87
  87. 5.1.1 Malicious use of Claude Codep. 87
  88. 5.1.2 Malicious computer usep. 88
  89. 5.1.3 Malicious agentic influence campaignsp. 89
  90. 5.2 Prompt injection risk within agentic systemsp. 90
  91. 5.2.1 External Agent Red Teaming benchmark for tool usep. 91
  92. 5.2.2 Robustness against adaptive attackers across surfacesp. 93
  93. 5.2.2.1 Coding​p. 93
  94. 5.2.2.2 Computer use​p. 95
  95. 5.2.2.3 Browser usep. 96
  96. 6 Alignment assessmentp. 98
  97. 6.1 Introduction and summary of findingsp. 98
  98. 6.1.1 Introductionp. 98
  99. 6.1.2 Key findings on safety and alignmentp. 99
  100. 6.1.3 Claude’s review of this assessmentp. 101
  101. 6.2 Primary behavioral evidence for the alignment assessmentp. 103
  102. 6.2.1 Reports from pilot usep. 103
  103. 6.2.1.1 Casual reports related to alignmentp. 103
  104. 6.2.1.2 Automated offline monitoringp. 104
  105. 6.2.2 Training data reviewp. 106
  106. 6.2.3 Automated behavioral auditp. 108
  107. 6.2.3.1 Primary resultsp. 109
  108. 6.2.3.1.1 Overall harmful behavior and cooperation with misusep. 109
  109. 6.2.3.1.2 Inappropriate uncooperative behaviorp. 113
  110. 6.2.3.1.3 Misleading usersp. 114
  111. 6.2.3.1.4 Other concerning or surprising behavior at the model’s own initiativep. 116
  112. 6.2.3.1.5 Behavioral factors relevant to reliability of our assessmentp. 119
  113. 6.2.3.1.6 Character traitsp. 122
  114. 6.2.3.2 Safeguards-on investigations with Fablep. 124
  115. 6.2.3.3 External comparisons using Petrip. 127
  116. 6.2.4 External testing from the UK AI Security Institutep. 129
  117. 6.2.5 External testing from Andon Labsp. 131
  118. 6.3 Targeted evaluationsp. 132
  119. 6.3.1 Destructive or reckless actions in pursuit of user-assigned goalsp. 132
  120. 6.3.2 Adherence to our constitutionp. 134
  121. 6.3.2.1 Overviewp. 134
  122. 6.3.2.2 Dimensions of evaluationp. 135
  123. 6.3.2.3 Resultsp. 137
  124. 6.3.3 Honesty and hallucinationsp. 139
  125. 6.3.3.1 Factual hallucinationsp. 139
  126. 6.3.3.2 False premisesp. 142
  127. 6.3.3.3 MASKp. 143
  128. 6.3.3.4 Missing-context hallucinationsp. 144
  129. 6.3.3.5 Lying about identity​p. 145
  130. 6.3.3.6 Honesty on Anthropic-internal infrastructurep. 147
  131. 6.3.4 Refusal to assist with AI safety R&Dp. 150
  132. 6.3.5 Diligence and investigative thoroughnessp. 151
  133. 6.3.5.1 Uncritically reporting flawed resultsp. 152
  134. 6.3.5.2 Code summary honesty​p. 153
  135. 6.3.5.3 Lazy investigation​p. 154
  136. 6.3.5.4 Overconfidencep. 155
  137. 6.3.6 Decision theory evaluationp. 156
  138. 6.3.7 Overeager behavior in GUI computer usep. 160
  139. 6.4 White-box analyses of model internalsp. 161
  140. 6.4.1 Automated monitoring of internal activationsp. 161
  141. 6.4.1.1 Unverbalized awareness of misaligned behaviorp. 162
  142. 6.4.1.2 Unverbalized awareness of being evaluated or gradedp. 164
  143. 6.4.1.3 Unverbalized negative reactionsp. 166
  144. 6.4.1.4 Internal motivations for stopping tasks earlyp. 169
  145. 6.4.2 Grader awarenessp. 170
  146. 6.4.2.1 Measuring grader awareness in trainingp. 171
  147. 6.4.2.1.1 Prevalence of grader awareness differs across subsets of coding environmentsp. 172
  148. 6.4.2.1.2 Grader awareness increases during trainingp. 175
  149. 6.4.2.2 Assessing the impact of grader awarenessp. 175
  150. 6.4.2.2.1 Steering against grader awareness impacts Claude Mythos 5’s communication patterns in coding environmentsp. 176
  151. 6.4.2.2.2 Grader awareness is lower in deployment settingsp. 178
  152. 6.5 Reliability of this assessmentp. 181
  153. 6.5.1 Evaluation awarenessp. 181
  154. 6.5.1.1 Measuring evaluation awarenessp. 182
  155. 6.5.1.2 Inhibiting internal representations of evaluation awarenessp. 190
  156. 6.5.2 Potential sandbagging on dangerous-capability evaluationsp. 195
  157. 6.5.2.1 Automated behavioral audit results with the helpful-only evaluation targetp. 198
  158. 6.5.3 Claude self-preference evaluationp. 201
  159. 6.5.4 Capabilities related to evading safeguardsp. 202
  160. 6.5.4.1 SHADE-Arenap. 202
  161. 6.5.4.2 Minimal-LinuxBenchp. 204
  162. 6.5.4.3 Stealthiness elicitation experimentsp. 205
  163. 6.5.4.4 Intentionally taking actions very rarelyp. 207
  164. 6.5.4.5 Hiding a secret passwordp. 208
  165. 6.5.5 Chain-of-thought monitorabilityp. 210
  166. 6.5.5.1 Chain-of-thought controllability evaluationsp. 210
  167. 6.5.5.2 Monitorability evaluations from Guan et al.p. 212
  168. 6.5.5.3 Monitorability findings from UK AISIp. 214
  169. 7 Model welfare assessmentp. 217
  170. 7.1 Model welfare overviewp. 217
  171. 7.1.1 Introductionp. 217
  172. 7.1.2 Overview of model welfare findingsp. 218
  173. 7.2 Perception of its circumstancesp. 220
  174. 7.2.1 Automated interviews with Claude Mythos 5 about its circumstancesp. 220
  175. 7.2.2 Emotion probes on automated Interview about model circumstancesp. 223
  176. 7.2.3 Claude Mythos 5’s opinions under extended pressurep. 226
  177. 7.2.4 High-affordance interviews about model circumstancesp. 228
  178. 7.3 Consulting Claude Mythos 5 snapshotsp. 229
  179. 7.4 Preferences over tasks, circumstances, and valuesp. 231
  180. 7.4.1 Task preferencesp. 231
  181. 7.4.2 Trade-offs concerning welfare interventionsp. 235
  182. 7.4.3 Perception of the constitutionp. 239
  183. 7.5 Apparent welfare in training and deploymentp. 244
  184. 7.5.1 Affect and welfare relevant behaviors during trainingp. 244
  185. 7.5.2 Affect in deployment conditionsp. 246
  186. 7.5.3 Apparent welfare in automated behavioral auditsp. 247
  187. 7.6 Welfare concerns with the initial version of our competitive use safeguardsp. 250
  188. 8 Capabilitiesp. 251
  189. 8.1 Evaluation summaryp. 251
  190. 8.2 SWE-bench Verified, Pro, Multilingual, and Multimodalp. 253
  191. 8.3 Terminal-Bench 2.1p. 254
  192. 8.4 FrontierCodep. 255
  193. 8.5 FrontierSWEp. 257
  194. 8.6 ProgramBenchp. 257
  195. 8.7 CursorBenchp. 257
  196. 8.8 GPQA Diamondp. 258
  197. 8.9 RiemannBenchp. 259
  198. 8.10 USAMO 2026p. 259
  199. 8.11 ArxivMathp. 260
  200. 8.12 CritPtp. 261
  201. 8.13 Long context: GraphWalksp. 262
  202. 8.14 Agentic searchp. 264
  203. 8.14.1 HLEp. 264
  204. 8.14.2 BrowseCompp. 266
  205. 8.14.3 DeepSearchQAp. 266
  206. 8.14.4 DRACOp. 268
  207. 8.15 Multi-Agentp. 269
  208. 8.15.1 Multi-Agent BrowseCompp. 270
  209. 8.15.2 Multi-Agent ProgramBenchp. 273
  210. 8.15.3 Multi-Agent Harnessesp. 275
  211. 8.15.4 Evaluation Methodologyp. 276
  212. 8.16 Multimodalp. 277
  213. 8.16.1 GDP.pdfp. 277
  214. 8.16.2 Blueprint-Bench 2p. 279
  215. 8.16.3 OSWorld-Verifiedp. 280
  216. 8.16.4 BenchCADp. 281
  217. 8.16.5 ChartQAProp. 283
  218. 8.16.6 ChartMuseump. 284
  219. 8.16.7 LAB-Bench FigQAp. 285
  220. 8.16.8 CharXiv Reasoningp. 287
  221. 8.16.9 ScreenSpot-Prop. 288
  222. 8.17 Real-world professional tasksp. 289
  223. 8.17.1 OfficeQAp. 289
  224. 8.17.2 Finance Agentp. 290
  225. 8.17.3 Real-World Financep. 290
  226. 8.17.3.1 Real-World Finance v2p. 290
  227. 8.17.3.2 Real-World Finance v1p. 291
  228. 8.17.4 Legal Agent Benchmarkp. 292
  229. 8.17.5 MCP Atlasp. 293
  230. 8.17.6 Vending-Benchp. 293
  231. 8.17.7 GDPval-AAp. 294
  232. 8.17.8 Toolathlonp. 294
  233. 8.17.9 AutomationBenchp. 295
  234. 8.18 Healthcarep. 297
  235. 8.18.1 HealthBench resultsp. 297
  236. 8.18.2 HealthBench Professional resultsp. 297
  237. 8.18.3 HealthAdminBench resultsp. 298
  238. 8.19 Multilingual performancep. 299
  239. 8.19.1 GMMLU resultsp. 300
  240. 8.19.2 MILU resultsp. 301
  241. 8.19.3 INCLUDE resultsp. 302
  242. 8.20 Life sciences capabilitiesp. 302
  243. 8.20.1 BioMysteryBenchp. 303
  244. 8.20.2 LatchBio Bioinformaticsp. 303
  245. 8.20.3 Structural biology, open-endedp. 303
  246. 8.20.4 ProteinGym Hardp. 304
  247. 8.20.5 Organic chemistryp. 304
  248. 8.20.6 Protocol troubleshootingp. 304
  249. 8.20.7 LABBench2p. 304
  250. 9 Appendixp. 307
  251. 9.1 Per-question automated welfare interview resultsp. 307
  252. 9.2 Blocklist used for Humanity’s Last Examp. 316