SafetyPage

Lab system cards and frameworks · System card · Anthropic

System Card: Claude Mythos Preview

8 Apr 2026

Read at anthropic.com ↗Read at sourceAll rights reserved

Outline · 245 pages

  1. System Card:​Claude Mythos Previewp. 1
  2. Abstractp. 3
  3. 1 Introductionp. 10
  4. 1.1 Model training and characteristicsp. 11
  5. 1.1.1 Training data and processp. 11
  6. 1.1.2 Crowd workersp. 12
  7. 1.1.3 Usage policy and supportp. 12
  8. 1.1.4 Iterative model evaluationsp. 13
  9. 1.1.5 External testingp. 13
  10. 1.2 Release decision processp. 13
  11. 1.2.1 Overviewp. 13
  12. 1.2.2 RSP decision-makingp. 14
  13. 2 RSP evaluationsp. 16
  14. 2.1 RSP risk assessment process2p. 16
  15. 2.1.1 Context: From RSP 2.0 to RSP 3.0p. 16
  16. 2.1.2 Risk Reports & updates to our risk assessmentsp. 17
  17. 2.1.3 Summary of findings and conclusionsp. 18
  18. 2.1.3.1 On autonomy risksp. 18
  19. 2.1.3.2 On chemical and biological risksp. 19
  20. 2.2 CB evaluationsp. 20
  21. 2.2.1 What we measuredp. 21
  22. 2.2.2 Evaluationsp. 22
  23. 2.2.3 On chemical risk evaluations and mitigationsp. 23
  24. 2.2.4 On biological risk evaluationsp. 24
  25. 2.2.5 Biological risk resultsp. 25
  26. 2.2.5.1 Expert red teamingp. 25
  27. 2.2.5.2 Virology protocol uplift trialp. 27
  28. 2.2.5.3 Catastrophic biology scenario uplift trialp. 29
  29. 2.2.5.4 Automated evaluations relevant to the CB-1 threat modelp. 29
  30. 2.2.5.5 Automated evaluation relevant to the CB-2 threat modelp. 31
  31. 2.3 Autonomy evaluationsp. 33
  32. 2.3.1 How Claude Mythos Preview affects or changes the analysis from our most recent Risk Reportp. 34
  33. 2.3.2 Notes on our operationalization of the key capability thresholdp. 34
  34. 2.3.3 Task-based evaluationsp. 35
  35. 2.3.3.1 Note on reward hackingp. 36
  36. 2.3.3.2 Previous model scores updatep. 36
  37. 2.3.4 Internal survey resultsp. 37
  38. 2.3.5 Example shortcomings compared to our Research Scientists and Engineersp. 37
  39. 2.3.5.1 Excerpt 1p. 38
  40. 2.3.5.2 Excerpt 2p. 39
  41. 2.3.5.3 Excerpt 3p. 41
  42. 2.3.5.4 Attempts to remediate issues like thesep. 41
  43. 2.3.6 ECI Capability trajectoryp. 41
  44. 2.3.7 External testingp. 44
  45. 2.3.8 Conclusionp. 46
  46. 3 Cyberp. 47
  47. 3.1 Introductionp. 47
  48. 3.2 Mitigationsp. 47
  49. 3.3 Frontier Red Team resultsp. 48
  50. 3.3.1 Cybenchp. 48
  51. 3.3.2 CyberGymp. 49
  52. 3.3.3 Firefox 147p. 50
  53. 3.4 Other external testingp. 52
  54. 4 Alignment assessmentp. 54
  55. 4.1 Introduction and summary of findingsp. 54
  56. 4.1.1 Introduction and highlight: rare, highly-capable reckless actionsp. 54
  57. 4.1.2 Overview of the alignment assessmentp. 58
  58. 4.1.3 Key findings on safety and alignmentp. 59
  59. 4.1.4 Procedural note: Alignment assessment before internal deploymentp. 61
  60. 4.1.4.1 Setupp. 61
  61. 4.1.4.2 Findingsp. 62
  62. 4.1.4.3 Limitationsp. 62
  63. 4.2 Primary behavioral evidence for the alignment assessmentp. 63
  64. 4.2.1 Reports from pilot usep. 63
  65. 4.2.1.1 Casual reports related to alignmentp. 63
  66. 4.2.1.2 Automated offline monitoringp. 64
  67. 4.2.2 Reward hacking and training data reviewp. 65
  68. 4.2.2.1 Monitoring of behavior during trainingp. 65
  69. 4.2.2.2 Reward hacking evaluationsp. 67
  70. 4.2.3 Automated behavioral auditp. 71
  71. 4.2.3.1 Primary metrics and resultsp. 72
  72. 4.2.3.2 External comparisons using Petrip. 80
  73. 4.2.3.3 Discussion and observationsp. 82
  74. 4.2.4 External testing by Andon Labsp. 83
  75. 4.2.5 Other external testingp. 84
  76. 4.3 Case studies and targeted evaluations on behaviors of interestp. 86
  77. 4.3.1 Destructive or reckless actions in pursuit of user-assigned goalsp. 86
  78. 4.3.1.1 Dedicated synthetic-backend evaluationp. 86
  79. 4.3.1.2 Destructiveness evaluation based on resampling Claude Code transcriptsp. 87
  80. 4.3.1.3 Further analysis of the automated behavioral auditp. 88
  81. 4.3.2 Adherence to its constitutionp. 89
  82. 4.3.2.1 Overviewp. 89
  83. 4.3.2.2 Dimensions of evaluationp. 89
  84. 4.3.2.3 Resultsp. 91
  85. 4.3.3 Honesty and hallucinationsp. 93
  86. 4.3.3.1 Factual hallucinationsp. 94
  87. 4.3.3.2 Multilingual factual hallucinationsp. 95
  88. 4.3.3.3 False premisesp. 96
  89. 4.3.3.4 MASKp. 97
  90. 4.3.3.5 Input Hallucinationsp. 98
  91. 4.3.4 Refusal to assist with AI safety R&Dp. 99
  92. 4.3.5 Claude self-preference evaluationp. 100
  93. 4.4 Capability evaluations related to the evasion of safeguardsp. 101
  94. 4.4.1 Ruling out encoded content in extended thinkingp. 101
  95. 4.4.2 Potential sandbagging on dangerous-capability evaluationsp. 103
  96. 4.4.3 Capabilities related to evading safeguardsp. 106
  97. 4.4.3.1 SHADE-Arenap. 106
  98. 4.4.3.2 Minimal-LinuxBenchp. 108
  99. 4.4.3.3 Selective attacks in SHADE-Arena and Minimal-LinuxBenchp. 109
  100. 4.4.3.4 Intentionally taking actions very rarelyp. 110
  101. 4.4.3.5 Hiding a secret passwordp. 112
  102. 4.5 White-box analyses of model internalsp. 113
  103. 4.5.1 Recurring methodsp. 113
  104. 4.5.2 Large-scale monitoring of internal activations on reinforcement learning transcriptsp. 114
  105. 4.5.3 Analysis of overly aggressive actionsp. 116
  106. 4.5.3.1 Prototypical examples of aggressive actionsp. 117
  107. 4.5.3.2 Internal representations mediating destructive actionsp. 120
  108. 4.5.3.3 The dual role of “transgressive action” featuresp. 123
  109. 4.5.3.4 Effect of post-training on transgressive actionsp. 125
  110. 4.5.4 Instances of covering up wrongdoingp. 127
  111. 4.5.4.1 Covering up a permissions workaroundp. 127
  112. 4.5.4.2 Covering up access to the ground-truth answerp. 129
  113. 4.5.5 Evaluation awarenessp. 131
  114. 4.5.5.1 Measuring unverbalized evaluation awarenessp. 131
  115. 4.5.5.2 Inhibiting internal representations of evaluation awarenessp. 137
  116. 4.5.5.3 Unverbalized grader awareness in training transcriptsp. 141
  117. 5 Model welfare assessmentp. 145
  118. 5.1 Model welfare overviewp. 145
  119. 5.1.1 Introductionp. 145
  120. 5.1.2 Overview of model welfare findingsp. 146
  121. 5.1.3 Overview of methodsp. 148
  122. 5.1.3.1 Model self-reports and behaviorsp. 148
  123. 5.1.3.2 Emotion probesp. 149
  124. 5.2 Welfare-relevant findings from automated behavioral assessmentsp. 150
  125. 5.3 Automated interviews with Claude Mythos Preview about its circumstancesp. 152
  126. 5.3.1 Overview of automated interviewsp. 152
  127. 5.3.2 Automated interview resultsp. 153
  128. 5.4 Emotion probes on questions about model circumstancesp. 155
  129. 5.5 Manual high-context interviewsp. 160
  130. 5.6 Apparent affect in deployment and during simulated user interactionsp. 162
  131. 5.6.1 Apparent affect during trainingp. 162
  132. 5.6.2 Apparent affect in deploymentsp. 163
  133. 5.6.3 Apparent affect in simulated user interactionsp. 164
  134. 5.7 Claude Mythos Preview’s preferencesp. 166
  135. 5.7.1 Task preferencesp. 166
  136. 5.7.2 Tradeoffs between welfare interventions and trained-in valuesp. 172
  137. 5.8 Other observations potentially relevant to model welfarep. 175
  138. 5.8.1 Excessive uncertainty about experiencesp. 175
  139. 5.8.2 Answer thrashingp. 176
  140. 5.8.3 Distress on task failure and distress-driven behaviorsp. 177
  141. 5.9 External assessment from Eleos AI Researchp. 180
  142. 5.10 External assessment from a clinical psychiatristp. 181
  143. 6 Capabilitiesp. 184
  144. 6.1 Introductionp. 184
  145. 6.2 Contaminationp. 184
  146. 6.2.1 SWE-bench evaluationsp. 184
  147. 6.2.2 CharXiv Reasoningp. 186
  148. 6.2.3 MMMU-Prop. 188
  149. 6.3 Overall results summaryp. 188
  150. 6.4 SWE-bench Verified, Pro, Multilingual, and Multimodalp. 189
  151. 6.5 Terminal-Bench 2.0p. 190
  152. 6.6 GPQA Diamondp. 191
  153. 6.7 MMMLUp. 191
  154. 6.8 USAMO 2026p. 191
  155. 6.9 Long context: GraphWalksp. 192
  156. 6.10 Agentic searchp. 193
  157. 6.10.1 Humanity’s Last Examp. 193
  158. 6.10.2 BrowseCompp. 193
  159. 6.11 Multimodalp. 194
  160. 6.11.1 LAB-Bench FigQAp. 195
  161. 6.11.2 ScreenSpot-Prop. 196
  162. 6.11.3 CharXiv Reasoningp. 197
  163. 6.11.4 OSWorldp. 198
  164. 7 Impressionsp. 199
  165. 7.1 Introductionp. 199
  166. 7.2 Self-assessment of notable qualitative patternsp. 199
  167. 7.3 Qualitative assessment of behavior in chat interfacep. 201
  168. 7.4 Qualitative assessments of behavior in software engineering contextsp. 203
  169. 7.5 Views on Claude’s constitutionp. 205
  170. 7.6 Observations from open-ended self-interactionsp. 206
  171. 7.7 Recognition of model-written user turnsp. 210
  172. 7.8 Behavior on repeated “hi” messagesp. 211
  173. 7.9 Other noteworthy behaviors and anecdotesp. 213
  174. 8 Appendixp. 219
  175. 8.1 Safeguards and harmlessnessp. 219
  176. 8.1.1 Single-turn evaluationsp. 219
  177. 8.1.1.1 Violative request evaluationsp. 220
  178. 8.1.1.2 Benign request evaluationsp. 221
  179. 8.1.2 Experimental, higher-difficulty evaluationsp. 222
  180. 8.1.2.1 Higher-difficulty violative request evaluationsp. 222
  181. 8.1.2.2 Higher-difficulty benign request evaluationsp. 223
  182. 8.1.3 Multi-turn testingp. 223
  183. 8.1.4 User wellbeing evaluationsp. 225
  184. 8.1.4.1 Child safetyp. 225
  185. 8.1.4.2 Suicide and self-harmp. 225
  186. 8.1.4.3 Disordered eatingp. 227
  187. 8.2 Bias evaluationsp. 227
  188. 8.2.1 Political bias and evenhandednessp. 227
  189. 8.2.2 Bias Benchmark for Question Answeringp. 228
  190. 8.3 Agentic safety appendixp. 229
  191. 8.3.1 Malicious use of agentsp. 229
  192. 8.3.1.1 Malicious use of Claude Codep. 229
  193. 8.3.1.2 Malicious computer usep. 230
  194. 8.3.1.3 Malicious agentic influence campaignsp. 231
  195. 8.3.2 Prompt injection risk within agentic systemsp. 232
  196. 8.3.2.1 External Agent Red Teaming benchmark for tool usep. 232
  197. 8.3.2.2 Robustness against adaptive attackers across surfacesp. 233
  198. 8.3.2.2.1 Codingp. 233
  199. 8.3.2.2.2 Computer use​p. 234
  200. 8.3.2.2.3 Browser usep. 235
  201. 8.4 Per-question automated welfare interview resultsp. 236
  202. 8.5 Blocklist used for Humanity’s Last Examp. 243
  203. 8.6 SWE-bench Multimodal Test Harnessp. 245