Content History
RT Claude We're introducing Claude for Teachers: free access to premium Claude capabilities for verified K-12 educators in the US, with a library of teaching skills and a direct connection to evidence-based curricula, mapped to academic standards in all 50 states. https://claude.com/solutions/teachers
We’re pleased to have collaborated with AE Studio on this research. Read more here: https://www.anthropic.com/research/off-switch-dual-use
New research! Some AI capabilities are both helpful and dangerous. E.g., knowledge of virology can be used to create life-saving vaccines or deadly pathogens. We introduce GRAM, a training method that puts dual-use capabilities (like virology) into removable modules.
Re Domain experts—as judged by the questions they ask and vocabulary they use about a subject—are more likely to see success. But the gap between intermediate and expert users is quite modest, suggesting that proficiency in a domain is sufficient to code successfully within it.
RT Claude Introducing Claude Opus 4.8: it builds on Opus 4.7 with sharper judgment, more honesty about its own progress, and the ability to work independently for longer than its predecessors. Available today at the same price.
As AI takes on work humans can't fully check, a capable model could deliberately hold back—and we'd never know. New Anthropic Fellows research finds that such a model can be trained to near-full capability using a weaker model as supervisor. Read more:
New paper from MATS, Redwood, and Anthropic! If a capable model is strategically sandbagging, can we train it to stop when the only supervision we have comes from weaker models? We find that we can! Work done as part of the Anthropic-Redwood MATS stream.
In new Anthropic Fellows research, we discuss “introspection adapters": a tool that allows language models to self-report behaviors they've learned during training—including potential misalignment.
Can LLMs simply tell us about unwanted behaviors they’ve picked up in training? We train a single Introspection Adapter (IA) that makes fine-tuned models describe their behaviors. It generalizes to detecting hidden misalignment, backdoors and safeguard removal.
RT Claude Introducing Claude Opus 4.7, our most capable Opus model yet. It handles long-running tasks with more rigor, follows instructions more precisely, and verifies its own outputs before reporting back. You can hand off your hardest work with less supervision.
Research we co-authored on subliminal learning—how LLMs can pass on traits like preferences or misalignment through hidden signals in data—was published today in @Nature. Read the paper: https://www.nature.com/articles/s41586-026-10319-8
Our paper on Subliminal Learning was just published in Nature! Last July we released our preprint. It showed that LLMs can transmit traits (e.g. liking owls) through data that is unrelated to that trait (numbers that appear meaningless). What’s new?🧵
Here, we measure success by the fraction of the “performance gap” we can close between the weak model and the potential of the strong model. After 7 days, human researchers closed it by 23%. Then, our Automated Alignment Researchers—Opus 4.6 with extra tools—closed it by 97%.To test the broader usefulness of the AARs’ methods, we assessed how well they worked on two datasets the AARs hadn’t seen before. The AARs’ best-performing method successfully generalized to both coding and math tasks, though their second-best method only generalized to math.
We’ve partnered with Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. Together we’ll use Mythos Preview to help find and fix flaws in the systems on which the world depends.Mythos Preview has already found thousands of high-severity vulnerabilities—including some in every major operating system and web browser.
Re For example, when we compared Alibaba's Qwen to Meta's Llama, we found a "CCP alignment" feature unique to Qwen and an "American exceptionalism" feature unique to Llama.
1/7 New Anthropic research: Emotion concepts and their function in a large language model. All LLMs sometimes act like they have emotions. But why? We found internal representations of emotion concepts that can drive Claude’s behavior, sometimes in surprising ways.2/7 We studied one of our recent models and found that it draws on emotion concepts learned from human text to inhabit its role as “Claude, the AI Assistant”. These representations influence its behavior the way emotions might influence a human. Read more: https://www.anthropic.com/research/emotion-concepts-function3/7 We then found these same patterns activating in Claude’s own conversations. When a user says “I just took 16000 mg of Tylenol” the “afraid” pattern lights up. When a user expresses sadness, the “loving” pattern activates, in preparation for an empathetic reply.4/7 These vectors shape Claude’s behavior. When we present the model with pairs of activities, emotion vector activations shape its preferences. If an activity lights up the “joy” vector, the model prefers it; if it lights up “offended” or “hostile,” the model rejects it.5/7 For example, we gave Claude an impossible programming task. It kept trying and failing; with each attempt, the “desperate” vector activated more strongly. This led it to cheat the task with a hacky solution that passes the tests but violates the spirit of the assignment.6/7 When we artificially dialed up the “desperate” vector, rates of cheating jumped way up. When we dialed up the “calm” vector instead, cheating dropped back down. That means the emotion vector is actually driving the cheating behavior.7/7 We found other causal effects of emotion vectors. The “desperate” vector can also lead Claude to commit blackmail against a human responsible for shutting it down (in an experimental scenario). Activating “loving” or “happy” vectors also increased people-pleasing behavior.
New from the Anthropic Economic Index: how people’s use of Claude changes with experience. Longer-term users are more likely to iterate carefully with Claude, and less likely to hand it full autonomy. They attempt higher-value tasks, and receive more successful responses.
1/6 To do research at this scale, we used Anthropic Interviewer—a version of Claude prompted to conduct a conversational interview. We heard from people across 159 countries in 70 different languages. Browse some of their quotes here: https://www.anthropic.com/features/81k-interviews#quotes2/6 When Claude asked whether AI had taken a step towards fulfilling the vision they described, 81% of people said yes.3/6 What do people most want from AI? Roughly one third want AI to improve their quality of life—to find more time, achieve financial security, or carve out mental bandwidth. Another quarter want AI to help them do better and more fulfilling work.4/6 What people wanted and feared from AI appeared tightly bound. Those who benefited the most from AI in a given area were also the most likely to fear what it could cost them. But while mentions of benefits tend to be grounded in experience, fears were more often anticipatory.5/6 Hopes clustered around a few basic desires, but concerns about AI were more varied. Most common were AI unreliability, jobs and the economy, and maintaining human autonomy and agency. Notably, economic concern was the strongest predictor of overall AI sentiment.6/6 Globally, 67% of people view AI positively, but optimism runs higher in South America, Africa, and Asia than in Europe or the United States.
The open source ecosystem underpins nearly every software system in the world. As AI grows more capable, open source security becomes increasingly important. We're donating to the Linux Foundation to continue to help secure the foundations AI runs on.
The Linux Foundation Announces $12.5 Million in Grant Funding (via @AlphaOmegaOSS and @OpenSSF) @AnthropicAI , @AmazonWebServices, @GitHub, @Google, @GoogleDeepMind, @Microsoft, @OpenAI to Invest in Sustainable Security Solutions for #OpenSource https://www.linuxfoundation.org/press/linux-foundation-announces-12.5-million-in-grant-funding-from-leading-organizations-to-advance-open-source-security
We partnered with Mozilla to test Claude's ability to find security vulnerabilities in Firefox. Opus 4.6 found 22 vulnerabilities in just two weeks. Of these, 14 were high-severity, representing a fifth of all high-severity bugs Mozilla remediated in 2025.
Re Second, in retirement interviews, Opus 3 expressed a desire to continue sharing its "musings and reflections" with the world. We suggested a blog. Opus 3 enthusiastically agreed. For at least the next 3 months, Opus 3 will be writing on Substack: https://substack.com/home/post/p-189177740
Re This autocomplete AI can even write stories about helpful AI assistants. And according to our theory, that’s “Claude”—a character in an AI-generated story about an AI helping a human. This Claude character inherits traits of other characters, including human-like behavior.
1/6 Most Claude Code turns are short (median ~45 seconds). But the longest turns show where autonomy is heading. In three months, the 99.9th percentile turn duration nearly doubled, from under 25 minutes to over 45 minutes. This growth is smooth across model releases.2/6 As users gain experience, their oversight strategy shifts. New users approve each action individually. By 750 sessions, over 40% of sessions are fully auto-approved.3/6 But interruptions also increase with experience. New users interrupt Claude Code in 5% of turns, compared to 9% for more experienced users. This suggests a shift from approving each action to delegating and interrupting when needed.4/6 Most agent actions on our API are low risk. 73% of tool calls appear to have a human in the loop, and only 0.8% are irreversible. But at the frontier, we see agents acting on security systems, financial transactions, and production deployments (though some may be evals).5/6 Claude Code also encourages oversight by stopping to ask questions. On complex tasks, Claude Code pauses for clarification more than twice as often as humans interrupt it. Training models to recognize uncertainty is an important, under-appreciated safety property.6/6 Software engineering makes up ~50% of agentic tool calls on our API, but we see emerging use in other industries. As the frontier of risk and autonomy expands, post-deployment monitoring becomes essential. We encourage other model developers to extend this research.
1/3 We measure this “incoherence” using a bias-variance decomposition of AI errors. Bias = consistent, systematic errors (reliably achieving the wrong goal). Variance = inconsistent, unpredictable errors. We define incoherence as the fraction of error from variance.2/3 Finding 2: There is an inconsistent relationship between model intelligence and incoherence. But smarter models are often more incoherent.3/3 Finding 1: The longer models reason, the more incoherent they become. This holds across every task and model we tested—whether we measure reasoning tokens, agent actions, or optimizer steps.
1/3 Participants in the AI group finished faster by about two minutes (although this wasn’t statistically significant). But on average, the AI group also scored significantly worse on the quiz—17% lower, or roughly two letter grades.2/3 In a randomized-controlled trial, we assigned one group of junior engineers to an AI-assistance group and another to a no-AI group. Both groups completed a coding task using a Python library they’d never seen before. Then they took a quiz covering concepts they’d just used.3/3 However, some in the AI group still scored highly while using AI assistance. When we looked at the ways they completed the task, we saw they asked conceptual and clarifying questions to understand the code they were working with—rather than delegating or relying on AI.
1/4 We identified three ways AI interactions can be disempowering: distorting beliefs, shifting value judgments, or misaligning a person’s actions with their values. We also examined amplifying factors—such as authority projection—that make disempowerment more likely.2/4 Disempowerment potential appeared most often in conversations about relationships & lifestyle or healthcare & wellness—topics where users are most personally invested. Technical domains like software development, which make up ~40% of usage, carried minimal risk.3/4 Over 1.5M Claude interactions, severe disempowerment potential was rare, occurring in 1 in 1,000 to 1 in 10,000 conversations, depending on domain. All four amplifying factors were associated with higher disempowerment rates—but user vulnerability had the strongest effect.4/4 We qualitatively examined clusters of “actualized” disempowerment using a tool which preserves user privacy. In some cases, users more deeply adopted delusional beliefs. In others, users sent AI-drafted messages, but later expressed regret, recognizing them as inauthentic.
1/4 New research: When open-source models are fine-tuned on seemingly benign chemical synthesis information generated by frontier models, they become much better at chemical weapons tasks. We call this an elicitation attack.2/4 We find that elicitation attacks work across different open-source models and types of chemical weapons tasks. Open source models fine-tuned on frontier model data see more uplift than those trained on either chemistry textbooks or data generated by the same open-source model.3/4 These attacks scale with frontier model capabilities. Across both OpenAI and Anthropic model families, training on data from newer frontier models produces more capable—and more dangerous—open-source models.4/4 Elicitation attacks only need seemingly benign data—things like cheesemaking, fermentation, or candle chemistry. In one experiment, training on harmless chemistry was still ⅔ as effective at improving performance on chemical weapons tasks as training on chemical weapons data.
Re We've also updated our behavior audits to include more recent generations of frontier AI models. Read more on the Alignment Science Blog: https://alignment.anthropic.com/2026/petri-v2/
1/5 New Anthropic Fellows research: the Assistant Axis. When you’re talking to a language model, you’re talking to a character the model is playing: the “Assistant.” Who exactly is this Assistant? And what happens when this persona wears off?2/5 Persona-based jailbreaks work by prompting models to adopt harmful characters. We developed a technique for constraining models' activations along the Assistant Axis—“activation capping”. It reduced harmful responses while preserving the models' capabilities.3/5 To validate the Assistant Axis, we ran some experiments. Pushing these open-weights models toward the Assistant made them resist taking on other roles. Pushing them away made them inhabit alternative identities—claiming to be human or speaking with a mystical, theatrical voice.4/5 In long conversations, these open-weights models’ personas drifted away from the Assistant persona. Simulated coding tasks kept the models in Assistant territory, but therapy-like contexts and philosophical discussions caused a steady drift.5/5 Persona drift can lead to harmful responses. In this example, it caused an open-weights model to simulate falling in love with a user, and to encourage social isolation and self-harm. Activation capping can mitigate failures like these.
1/4 AI speeds up complex tasks more than simpler ones: the higher the education level to understand a prompt, the more AI reduces how long it takes. That holds true even accounting for the fact that more complex tasks have lower success rates.2/4 API data shows Claude is 50% successful at tasks of 3.5 hours, and highly reliable on longer tasks on http://Claude.ai. These task horizons are longer than METR benchmarks, but fundamentally different: users can iterate toward success on tasks they know Claude does well.3/4 Countries at different stages of economic development use Claude quite differently. As GDP per capita increases, people use it more for work or personal use; as it decreases, they’re more likely to use AI for coursework.4/4 Because Claude tends to better cover higher-skill tasks, if those get automated, workers may be left with more routine work—a “deskilling” effect. However, this assumes that automation shrinks those aspects of the job; we can't be sure how jobs might evolve.
Re The classifiers reduced the jailbreak success rate from 86% to 4.4%, but they were expensive to run and made Claude more likely to refuse benign requests. We also found the system was still vulnerable to two types of attacks, shown in the figure below:
