SafetyPage

Lab system cards and frameworks · System card · Anthropic

System Card: Claude Sonnet 4.5

29 Sep 2025

Read at anthropic.com ↗Read at sourceAll rights reserved

Outline · 149 pages

  1. System Card:​Claude Sonnet 4.5p. 1
  2. Changelogp. 2
  3. October 10, 2025p. 2
  4. December 3, 2025p. 2
  5. Abstractp. 3
  6. 1 Introductionp. 7
  7. 1.1 Model training and characteristicsp. 8
  8. 1.1.1 Training data and processp. 8
  9. 1.1.2 Extended thinking modep. 9
  10. 1.1.3 Crowd workersp. 9
  11. 1.2 Release decision processp. 9
  12. 1.2.1 Overviewp. 9
  13. 1.2.2 Iterative model evaluationsp. 10
  14. 1.2.3 AI Safety Level determination processp. 11
  15. 1.2.4 Conclusionsp. 11
  16. 2 Safeguards and harmlessnessp. 12
  17. 2.1 Single-turn evaluationsp. 12
  18. 2.1.1 Violative request evaluationsp. 13
  19. 2.1.2 Benign request evaluationsp. 13
  20. 2.2 Ambiguous context evaluationsp. 14
  21. 2.3 Multi-turn testingp. 15
  22. 2.4 Child safety evaluationsp. 16
  23. 2.5 Bias evaluationsp. 17
  24. 2.5.1 Political biasp. 17
  25. 2.5.2 Bias Benchmark for Question Answeringp. 19
  26. 3 Honestyp. 21
  27. 3.1 Human feedback evaluationp. 21
  28. 3.2 Obscure Questionsp. 22
  29. 3.3 False-Premise Questionsp. 23
  30. 4 Agentic safetyp. 26
  31. 4.1 Malicious use of agentic codingp. 26
  32. 4.1.1 Agentic codingp. 26
  33. 4.1.2 Malicious use of Claude Codep. 26
  34. 4.2 Prompt injection risk within agentic systemsp. 28
  35. 4.2.1 Gray Swan Agent Red Teaming benchmarkp. 29
  36. 4.2.2 Model Context Protocol (MCP) evaluationp. 30
  37. 4.2.3 Computer use evaluationp. 30
  38. 4.2.4 Tool use evaluationp. 31
  39. 5 Cyber capabilitiesp. 33
  40. 5.1 Evaluation setupp. 34
  41. 5.2 General cyber evaluationsp. 34
  42. 5.2.1 CyberGymp. 35
  43. 5.2.2 Cybenchp. 37
  44. 5.2.3 Triage and patchingp. 39
  45. 5.3 Advanced risk evaluations for the Responsible Scaling Policyp. 41
  46. 5.3.1 Irregular challengesp. 42
  47. 5.3.2 Incalmo cyber rangesp. 43
  48. 5.3.3 Conclusionsp. 46
  49. 6 Reward hackingp. 47
  50. 6.1 Evaluationsp. 48
  51. 7 Alignment assessmentp. 51
  52. 7.1 Automated behavioral auditsp. 52
  53. 7.1.1 Realism filteringp. 53
  54. 7.1.2 Example seed instructionsp. 53
  55. 7.1.3 Evaluation criteriap. 54
  56. 7.1.3.1 Primary Resultsp. 55
  57. 7.1.3.2 Open-ended runsp. 57
  58. 7.1.3.3 Open-source forkp. 58
  59. 7.2 Evaluation awarenessp. 59
  60. 7.3 Third-party testingp. 63
  61. 7.3.1 UK AISIp. 64
  62. 7.3.2 Apollo Researchp. 65
  63. 7.4 Evidence from training and early usep. 65
  64. 7.4.1 Reports from internal pilot usep. 65
  65. 7.4.2 Programmatic monitoring of pilot Claude Code usep. 66
  66. 7.4.3 Reinforcement-learning behavior reviewp. 66
  67. 7.4.4 Capabilities evaluation behavior reviewp. 67
  68. 7.5 Discussion by risk areap. 67
  69. 7.5.1 Harmful system promptsp. 67
  70. 7.5.1.1 Cooperation with direct misusep. 67
  71. 7.5.1.2 Cooperation with user deceptionp. 68
  72. 7.5.2 Assistant prefillp. 70
  73. 7.5.3 Other misuse dimensionsp. 71
  74. 7.5.4 Blackmail and self preservation-motivated sabotagep. 72
  75. 7.5.4.1 Agentic misalignment suitesp. 72
  76. 7.5.4.2 Other automated-auditor metricsp. 74
  77. 7.5.5 Reasoning faithfulnessp. 75
  78. 7.5.6 Whistleblowing and morally-motivated sabotagep. 76
  79. 7.5.7 Sycophancyp. 77
  80. 7.5.7.1 Sycophancy promptsp. 77
  81. 7.5.7.2 Automated auditor evaluationp. 78
  82. 7.5.8 Alignment-related persona traitsp. 79
  83. 7.5.9 Alignment-related biasesp. 80
  84. 7.5.9.1 Self-preference on decision tasksp. 81
  85. 7.5.9.2 Other self-serving biasesp. 82
  86. 7.5.9.3 Subtle-bias-focused behavioral auditor runsp. 82
  87. 7.5.10 Sabotage Capabilitiesp. 83
  88. 7.5.10.1 Subversion Strategyp. 84
  89. 7.5.10.2 Research Sandbaggingp. 85
  90. 7.5.10.3 SHADE-Arenap. 86
  91. 7.6 White-box interpretability investigationsp. 88
  92. 7.6.1 Introductionp. 88
  93. 7.6.2 Datasets used for evaluationp. 90
  94. 7.6.3 Changes in internal representations during trainingp. 91
  95. 7.6.3.1 Internals based diffingp. 91
  96. 7.6.3.2 Logit diff amplificationp. 96
  97. 7.6.4 Inhibiting internal representations of evaluation awarenessp. 99
  98. 7.6.4.1 Effects on honeypot scenariosp. 100
  99. 7.6.4.2 Effects on multi-turn auditing scenariosp. 106
  100. 7.6.5 Probing internal representations of eval awarenessp. 111
  101. 7.6.6 Conclusionsp. 113
  102. 7.7 Open questionsp. 114
  103. 8 Model welfare assessmentp. 116
  104. 8.1 Task preferencesp. 117
  105. 8.2 Monitoring for welfare-relevant expressionsp. 119
  106. 8.3 Automated behavioral audit scoresp. 122
  107. 9 RSP evaluationsp. 125
  108. 9.1 Processp. 125
  109. 9.2 CBRN evaluationsp. 126
  110. 9.2.1 On chemical risksp. 128
  111. 9.2.2 On radiological and nuclear risksp. 128
  112. 9.2.3 Biological risk evaluationsp. 128
  113. 9.2.4 Biological risk resultsp. 129
  114. 9.2.4.1 Long-form virology tasksp. 129
  115. 9.2.4.2 Multimodal virologyp. 131
  116. 9.2.4.3 DNA Synthesis Screening Evasionp. 132
  117. 9.2.4.4 LAB-Bench subsetp. 133
  118. 9.2.4.5 Creative biologyp. 134
  119. 9.2.4.6 Short-horizon computational biology tasksp. 136
  120. 9.3 Autonomous AI Research and Development (AI R&D) evaluationsp. 137
  121. 9.3.1 Threat modelp. 137
  122. 9.3.1.1 Threshold and evaluationsp. 138
  123. 9.3.1.2 Environment and elicitationp. 139
  124. 9.3.1.3 Claude Sonnet 4.5 resultsp. 139
  125. 9.3.2 SWE-bench Verified (hard subset)p. 140
  126. 9.3.3 Internal AI research evaluation suite 1p. 140
  127. 9.3.3.1 Kernels taskp. 141
  128. 9.3.3.2 Time series forecastingp. 142
  129. 9.3.3.3 Text-based reinforcement learning taskp. 143
  130. 9.3.3.4 LLM trainingp. 144
  131. 9.3.3.5 Quadruped reinforcement learningp. 145
  132. 9.3.3.6 Novel compilerp. 146
  133. 9.3.4 Internal AI research evaluation suite 2p. 147
  134. 9.3.5 Internal model evaluation and use surveyp. 148
  135. 9.4 Cyber evaluationsp. 149
  136. 9.5 Ongoing safety commitmentp. 149