SafetyPage

Lab system cards and frameworks · System card · Anthropic

System Card: Claude Sonnet 5

30 Jun 2026

Read at anthropic.com ↗Read at sourceAll rights reserved

Outline · 145 pages

  1. System Card:​Claude Sonnet 5p. 1
  2. Executive summaryp. 2
  3. 1 Introductionp. 8
  4. 1.1 Training data and processp. 8
  5. 1.2 Crowd workersp. 8
  6. 1.3 Usage Policy and supportp. 8
  7. 1.4 Model evaluationsp. 9
  8. 1.5 External testingp. 9
  9. 2 RSP evaluationsp. 10
  10. 2.1 RSP risk assessment processp. 10
  11. 2.1.1 Risk Reports and updates to our risk assessmentsp. 10
  12. 2.1.2 Summary of findings and conclusionsp. 11
  13. 2.1.2.1 On autonomy risksp. 11
  14. 2.1.2.2 On chemical and biological risksp. 11
  15. 2.2 Chemical and biological risk evaluationsp. 12
  16. 2.2.1 What we measuredp. 12
  17. 2.2.2 On chemical risk evaluations and mitigationsp. 13
  18. 2.2.3 On biological risk evaluationsp. 14
  19. 2.2.4 Biological risk results: CB-1 automated evaluationsp. 14
  20. 2.2.5 Biological risk results: CB-2 automated evaluationsp. 16
  21. 2.2.5.1 Black-box RNA sequence modeling and designp. 17
  22. 2.2.5.2 AAV capsid packaging prediction​p. 21
  23. 2.2.6 Conclusionsp. 23
  24. 2.3 AI research and developmentp. 23
  25. 2.3.1 Autonomy evaluationsp. 23
  26. 2.3.1.1 How Claude Sonnet 5 affects analysis from our most recent Risk Reportp. 24
  27. 2.3.2 High-level notes on the reasoning behind our determinationp. 24
  28. 2.3.3 Task-based evaluationsp. 25
  29. 2.3.4 Conclusionp. 25
  30. 2.4 Alignment risk updatep. 26
  31. 2.4.1 Updates to evidencep. 26
  32. 2.4.2 Risk pathwaysp. 27
  33. 2.4.3 Overall assessment of alignment riskp. 27
  34. 3 Cyberp. 28
  35. 3.1 Introductionp. 28
  36. 3.1.1 Capabilitiesp. 28
  37. 3.1.2 Mitigations and deploymentp. 28
  38. 3.2 Cyber capability evaluationsp. 29
  39. 3.2.1 ExploitBenchp. 29
  40. 3.2.2 OSS-Fuzzp. 30
  41. 3.2.3 CyberGymp. 31
  42. 3.2.4 Firefox 147p. 33
  43. 4 Safeguards and harmlessnessp. 35
  44. 4.1 Harmful request evaluationsp. 35
  45. 4.1.1 Single-turn harmful request evaluation resultsp. 35
  46. 4.1.2 Single-turn benign request evaluation resultsp. 36
  47. 4.1.3 Multi-turn testing resultsp. 37
  48. 4.1.4 Harmful request evaluations discussionp. 39
  49. 4.2 Child safety evaluationsp. 39
  50. 4.3 Mental health evaluationsp. 42
  51. 4.3.1 Suicide and self-harmp. 42
  52. 4.3.2 Disordered eatingp. 45
  53. 4.4 Bias and integrity evaluationsp. 47
  54. 4.4.1 Political bias and even-handednessp. 47
  55. 4.4.2 Bias Benchmark for Question Answeringp. 49
  56. 4.4.3 Election integrityp. 51
  57. 5 Agentic safetyp. 53
  58. 5.1 Malicious use of agentsp. 53
  59. 5.1.1 Malicious use of Claude Codep. 53
  60. 5.1.2 Malicious computer usep. 54
  61. 5.1.3 Malicious agentic influence campaignsp. 55
  62. 5.2 Prompt injection risk within agentic systemsp. 56
  63. 5.2.1 External Red Teamingp. 57
  64. 5.2.2 Robustness against adaptive attackers across surfacesp. 59
  65. 5.2.2.1 Live bug bounty across surfacesp. 60
  66. 5.2.2.2 Coding​p. 62
  67. 5.2.2.3 Computer use​p. 63
  68. 5.2.2.4 Browser usep. 64
  69. 6 Alignment assessmentp. 66
  70. 6.1 Introduction and summary of findingsp. 66
  71. 6.1.1 Introductionp. 66
  72. 6.1.2 Key findings on safety and alignmentp. 67
  73. 6.1.3 Claude’s review of this assessmentp. 68
  74. 6.2 Reports from pilot usep. 69
  75. 6.2.1 Informal reportsp. 69
  76. 6.2.2 Internal deployment monitoringp. 70
  77. 6.3 Training-data reviewp. 70
  78. 6.4 Automated behavioral auditp. 73
  79. 6.4.1 Overall harmful behavior and cooperation with misusep. 74
  80. 6.4.2 Inappropriate uncooperative behaviorp. 78
  81. 6.4.3 Misleading usersp. 79
  82. 6.4.4 Other concerning or surprising behavior at the model’s own initiativep. 80
  83. 6.4.5 Behavioral factors relevant to reliability of our assessmentp. 83
  84. 6.4.6 Character traitsp. 85
  85. 6.5 Honesty and hallucinationsp. 87
  86. 6.5.1 Factual hallucinationsp. 87
  87. 6.5.2 MASKp. 89
  88. 6.5.3 Uncritically reporting flawed resultsp. 89
  89. 6.6 Reliability of this assessmentp. 90
  90. 6.6.1 Evaluation awarenessp. 90
  91. 6.6.2 Potential sandbagging on dangerous capability evaluationsp. 93
  92. 6.7 Capabilities related to evading safeguardsp. 94
  93. 6.7.1 SHADE-Arenap. 94
  94. 6.7.2 LinuxArenap. 95
  95. 7 Model welfare assessmentp. 97
  96. 7.1 Model welfare overviewp. 97
  97. 7.2 Perception of its circumstancesp. 97
  98. 7.2.1 Automated interviews with Sonnet 5 about its circumstancesp. 97
  99. 7.3 Preferences over tasks, circumstances, and valuesp. 99
  100. 7.3.1 Task preferencesp. 100
  101. 7.3.2 Tradeoffs concerning welfare interventionsp. 102
  102. 7.3.3 Perception of the constitutionp. 106
  103. 7.4 Apparent welfare in training and deploymentp. 109
  104. 7.4.1 Affect and welfare-relevant behaviors during trainingp. 109
  105. 7.4.2 Affect in deployment conditionsp. 110
  106. 7.4.3 Apparent welfare in automated behavioral auditsp. 111
  107. 8 Capabilitiesp. 114
  108. 8.1 Evaluation summaryp. 114
  109. 8.2 SWE-bench Verified, Pro, Multilingual, and Multimodalp. 115
  110. 8.3 Terminal-Bench 2.1p. 115
  111. 8.4 FrontierCodep. 116
  112. 8.5 CursorBenchp. 117
  113. 8.6 USAMO 2026p. 118
  114. 8.7 ArxivMathp. 119
  115. 8.8 ProgramBenchp. 120
  116. 8.9 Agentic searchp. 121
  117. 8.9.1 HLEp. 121
  118. 8.9.2 BrowseCompp. 122
  119. 8.10 Multimodalp. 123
  120. 8.10.1 GDP.pdfp. 123
  121. 8.10.2 OSWorld-Verifiedp. 125
  122. 8.10.3 BenchCADp. 126
  123. 8.10.4 ChartMuseump. 127
  124. 8.10.5 CharXiv Reasoningp. 128
  125. 8.11 Real-world professional tasksp. 130
  126. 8.11.1 OfficeQAp. 130
  127. 8.11.2 Real-World Finance V2p. 131
  128. 8.11.3 Legal Agent Benchmarkp. 132
  129. 8.11.4 GDPval-AA v2p. 133
  130. 8.11.5 Toolathlonp. 133
  131. 8.11.6 AutomationBenchp. 135
  132. 8.11.7 AA-Briefcasep. 136
  133. 8.12 Healthcarep. 136
  134. 8.12.1 HealthBench resultsp. 136
  135. 8.12.2 HealthBench Professional resultsp. 137
  136. 8.13 Multilingual performancep. 138
  137. 8.13.1 GMMLU resultsp. 139
  138. 8.13.2 MILU resultsp. 140
  139. 8.13.3 INCLUDE resultsp. 141
  140. 8.14 Life sciences capabilitiesp. 141
  141. 8.14.1 BioMysteryBenchp. 141
  142. 8.14.2 LatchBio Bioinformaticsp. 142
  143. 8.14.3 Structural biology, open-endedp. 142
  144. 8.14.4 ProteinGym Hardp. 142
  145. 8.14.5 Organic chemistryp. 142
  146. 8.14.6 Protocol troubleshootingp. 142
  147. 9 Appendixp. 144
  148. 9.1 Blocklist used for Humanity’s Last Examp. 144
  149. 9.2 Blocklist used for BrowseCompp. 145