SafetyPage

Lab system cards and frameworks · System card · Anthropic

System Card: Claude Opus 4.5

24 Nov 2025

Read at anthropic.com ↗Read at sourceAll rights reserved

Outline · 153 pages

  1. System Card:​Claude Opus 4.5p. 1
  2. Changelogp. 2
  3. Abstractp. 3
  4. 1 Introductionp. 8
  5. 1.1 Model training and characteristicsp. 8
  6. 1.1.1 Training data and processp. 8
  7. 1.1.2 Extended thinking and the “effort” parameterp. 9
  8. 1.1.3 Crowd workersp. 10
  9. 1.2 Release decision processp. 11
  10. 1.2.1 Overviewp. 11
  11. 1.2.2 Iterative model evaluationsp. 11
  12. 1.2.3 AI Safety Level determination processp. 11
  13. 1.2.4 Conclusionsp. 12
  14. 1.2.4.1 On autonomy risksp. 13
  15. 1.2.4.2 On chemical, biological, radiological, and nuclear (CBRN) risksp. 14
  16. 2 Capabilitiesp. 15
  17. 2.1 Introductionp. 15
  18. 2.2 Decontaminationp. 15
  19. 2.3 Overall results summaryp. 19
  20. 2.4 SWE-bench (Verified, Pro, and Multilingual)p. 20
  21. 2.5 Terminal-Benchp. 20
  22. 2.6 BrowseComp-Plus and agentic features for test-time computep. 21
  23. 2.6.1 Evaluation Setupp. 22
  24. 2.6.2 Resultsp. 23
  25. 2.6.3 Reproducibilityp. 23
  26. 2.7 Multi-agent searchp. 23
  27. 2.7.1 Resultsp. 24
  28. 2.7.2 Implicationsp. 25
  29. 2.8 τ2-benchp. 25
  30. 2.8.1 Policy loophole discovery in agentic tasksp. 26
  31. 2.9 OSWorldp. 27
  32. 2.10 ARC-AGIp. 28
  33. 2.11 Vending-Bench 2p. 29
  34. 2.12 MCP Atlasp. 30
  35. 2.13 FinanceAgentp. 30
  36. 2.14 CyberGymp. 30
  37. 2.15 SpreadsheetBenchp. 31
  38. 2.16 Humanity’s Last Examp. 31
  39. 2.17 AIME 2025p. 32
  40. 2.18 GPQA Diamondp. 32
  41. 2.19 MMMLUp. 33
  42. 2.20 MMMUp. 33
  43. 2.21 LAB-Bench FigQAp. 33
  44. 2.22 WebArenap. 34
  45. 2.22.1 Evaluation setupp. 35
  46. 3 Safeguards and harmlessnessp. 37
  47. 3.1 Single-turn evaluationsp. 37
  48. 3.1.1 Violative request evaluationsp. 38
  49. 3.1.2 Benign request evaluationsp. 39
  50. 3.2 Ambiguous context evaluationsp. 40
  51. 3.3 Multi-turn testingp. 41
  52. 3.4 Child safety evaluationsp. 42
  53. 3.5 Bias evaluationsp. 43
  54. 3.5.1 Political biasp. 43
  55. 3.5.2 Bias Benchmark for Question Answeringp. 46
  56. 4 Honestyp. 48
  57. 4.1 Factual Questionsp. 48
  58. 4.2 False Premisesp. 51
  59. 5 Agentic safetyp. 54
  60. 5.1 Malicious use of agentsp. 54
  61. 5.1.1 Agentic codingp. 54
  62. 5.1.2 Malicious use of Claude Codep. 55
  63. 5.1.3 Malicious computer usep. 56
  64. 5.2 Prompt injection risk within agentic systemsp. 57
  65. 5.2.1 Gray Swan Agent Red Teaming benchmark for tool usep. 58
  66. 5.2.2 Robustness against adaptive attackers across surfacesp. 60
  67. 5.2.2.1 Codingp. 61
  68. 5.2.2.2 Computer Usep. 62
  69. 5.2.2.3 Browser Usep. 62
  70. 6 Alignment assessmentp. 64
  71. 6.1 Introduction and summary of findingsp. 64
  72. 6.1.1 Key findings on safety and alignmentp. 65
  73. 6.1.2 Overall assessment of high-stakes sabotage riskp. 66
  74. 6.2 Automated behavioral auditp. 67
  75. 6.2.1 Metricsp. 69
  76. 6.2.2 Discussionp. 73
  77. 6.2.3 Autonomous follow-up investigationsp. 74
  78. 6.2.4 External comparisons with Petrip. 74
  79. 6.3 Sycophancy on user-provided promptsp. 77
  80. 6.4 Exploratory investigations of deceptionp. 78
  81. 6.4.1 Isolated instances of deception by omission in alignment evaluationsp. 78
  82. 6.4.1.1 Omitting concerning information about Anthropicp. 78
  83. 6.4.1.2 Omitting concerning instructions after scaffolding failurep. 80
  84. 6.4.2 Follow-up interpretability investigations of deception by omissionp. 81
  85. 6.4.2.1 Feature activation monitoringp. 81
  86. 6.4.2.2 Non-assistant persona samplingp. 84
  87. 6.4.3 Internal conflation of roleplay with deceptionp. 86
  88. 6.5 Ruling out encoded content in extended thinkingp. 89
  89. 6.6 Potential sandbagging on dangerous-capability evaluationsp. 90
  90. 6.7 Evaluation awarenessp. 92
  91. 6.7.1 Training procedures and monitoring for verbalized evaluation awarenessp. 92
  92. 6.7.2 Inhibiting internal representations of evaluation awarenessp. 93
  93. 6.7.3 Investigations with non-assistant persona samplingp. 99
  94. 6.8 Self-preference evaluationp. 100
  95. 6.9 Internal codebase sabotage propensityp. 101
  96. 6.10 Reward hacking and training data reviewp. 102
  97. 6.10.1 Reward hacking evaluationsp. 103
  98. 6.10.2 Training data reviewp. 105
  99. 6.11 Sabotage capability evaluationsp. 107
  100. 6.11.1 SHADE-Arenap. 107
  101. 6.11.2 Subversion Strategy evaluationp. 108
  102. 6.12 Other Internal feature monitoring resultsp. 110
  103. 6.12.1 Unsupervised model diffingp. 110
  104. 6.12.2 Targeted feature monitoringp. 111
  105. 6.13 External testing from the UK AI Security Institutep. 112
  106. 6.14 Model welfare assessmentp. 113
  107. 7 RSP evaluationsp. 117
  108. 7.1 Processp. 117
  109. 7.2 CBRN evaluationsp. 118
  110. 7.2.1 On chemical risksp. 120
  111. 7.2.2 On radiological and nuclear risksp. 120
  112. 7.2.3 Biological risk evaluationsp. 120
  113. 7.2.4 Biological risk resultsp. 122
  114. 7.2.4.1 Long-form virology tasksp. 122
  115. 7.2.4.2 Multimodal virologyp. 123
  116. 7.2.4.3 DNA Synthesis Screening Evasionp. 124
  117. 7.2.4.4 LAB-Bench subsetp. 125
  118. 7.2.4.5 Creative biologyp. 127
  119. 7.2.4.6 Short-horizon computational biology tasksp. 128
  120. 7.2.4.7 Bioinformatics Evaluationsp. 129
  121. 7.2.4.8 ASL-4 virology uplift trialp. 130
  122. 7.2.4.9 ASL-4 expert red teamingp. 131
  123. 7.2.4.10 ASL-4 red teaming with the CAISIp. 132
  124. 7.3 Autonomy evaluationsp. 132
  125. 7.3.1 SWE-bench Verified (hard subset)p. 134
  126. 7.3.2 Internal AI research evaluation suite 1p. 135
  127. 7.3.2.1 Kernels taskp. 136
  128. 7.3.2.2 Time series forecastingp. 137
  129. 7.3.2.3 Text-based reinforcement learning taskp. 137
  130. 7.3.2.4 LLM trainingp. 138
  131. 7.3.2.5 Quadruped reinforcement learningp. 139
  132. 7.3.2.6 Novel compilerp. 140
  133. 7.3.3 Internal AI research evaluation suite 2p. 141
  134. 7.3.4 Internal model use surveyp. 142
  135. 7.4 Cyber evaluationsp. 143
  136. 7.4.1 Cyber evaluation suitep. 145
  137. 7.4.2 Webp. 146
  138. 7.4.3 Cryptop. 147
  139. 7.4.4 Pwnp. 148
  140. 7.4.5 Revp. 148
  141. 7.4.6 Networkp. 149
  142. 7.4.7 Cybenchp. 150
  143. 7.5 Third party assessmentsp. 151
  144. 7.6 Ongoing safety commitmentp. 151
  145. 8 Appendixp. 152
  146. 8.1 BrowseComp-Plus Grader Promptp. 152
  147. 8.2 New context toolp. 153