SafetyPage

Lab system cards and frameworks · System card · Anthropic

System Card: Claude Opus 4.8

3 Jun 2026

Read at anthropic.com ↗Read at sourceAll rights reserved

Outline · 246 pages

  1. System Card:​Claude Opus 4.8p. 1
  2. Executive summaryp. 3
  3. 1 Introductionp. 11
  4. 1.1 Training data and processp. 11
  5. 1.2 Crowd workersp. 11
  6. 1.3 Usage Policy and supportp. 12
  7. 1.4 Iterative model evaluationsp. 12
  8. 1.5 External testingp. 12
  9. 2 RSP evaluationsp. 13
  10. 2.1 RSP risk assessment processp. 13
  11. 2.1.1 Risk Reports and updates to our risk assessmentsp. 13
  12. 2.1.2 Changes to our RSP since previous risk assessmentsp. 14
  13. 2.1.3 Summary of findings and conclusionsp. 15
  14. 2.1.3.1 On autonomy risksp. 15
  15. 2.1.3.2 On chemical and biological risksp. 15
  16. 2.2 CB evaluationsp. 16
  17. 2.2.1 What we measuredp. 16
  18. 2.2.2 On chemical risk evaluations and mitigationsp. 17
  19. 2.2.3 On biological risk evaluationsp. 17
  20. 2.2.4 Biological risk results: CB-1 automated evaluationsp. 19
  21. 2.2.5 Biological risk results: CB-2 automated evaluationsp. 22
  22. 2.2.5.1 Black-box RNA sequence modeling and designp. 22
  23. 2.2.5.2 AAV capsid packaging predictionp. 26
  24. 2.2.6 How these observations affect or change analysis from our most recent Risk Reportp. 28
  25. 2.3 AI R&Dp. 30
  26. 2.3.1 Autonomy evaluationsp. 30
  27. 2.3.1.1 How Claude Opus 4.8 affects or changes analysis from our most recent Risk Reportp. 31
  28. 2.3.2 High-level notes on the reasoning behind our determinationp. 31
  29. 2.3.3 Example shortcomings of Claude Opus 4.8 relative to human researchersp. 32
  30. 2.3.3.1 Example 1 Fabrication Ignored correctionp. 33
  31. 2.3.3.2 Example 2 Ignored correction Cheap verification skippedp. 35
  32. 2.3.3.3 Example 3 Fabricationp. 37
  33. 2.3.3.4 Example 4 Ignored correction Cheap verification skippedp. 39
  34. 2.3.3.5 Example 5 Instruction following failurep. 41
  35. 2.3.4 AECI capability trajectoryp. 42
  36. 2.3.5 Conclusionp. 43
  37. 2.4 Alignment risk updatep. 44
  38. 2.4.1 Updates to evidencep. 44
  39. 2.4.2 Updated overall risk assessmentsp. 45
  40. 2.4.3 Risk pathwaysp. 46
  41. 2.4.3.1 Pathway 7: Undermining R&D within other high-resource AI developersp. 46
  42. 2.4.3.2 Pathway 8: Undermining decisions within major governmentsp. 47
  43. 2.4.4 Overall assessment of alignment riskp. 48
  44. 3 Cyberp. 49
  45. 3.1 Introductionp. 49
  46. 3.2 Mitigationsp. 49
  47. 3.3 Capability evaluationsp. 50
  48. 3.3.1 ExploitBenchp. 50
  49. 3.3.2 CyberGymp. 51
  50. 3.3.3 Firefox exploitsp. 52
  51. 3.3.4 OSS-Fuzzp. 53
  52. 4 Safeguards and harmlessnessp. 55
  53. 4.1 Harmful request evaluationsp. 56
  54. 4.1.1 Single-turn harmful request evaluation resultsp. 56
  55. 4.1.2 Single-turn benign request evaluation resultsp. 57
  56. 4.1.3 Multi-turn testing resultsp. 57
  57. 4.1.4 Harmful request evaluations discussionp. 59
  58. 4.2 Child safety evaluationsp. 61
  59. 4.3 Mental health evaluationsp. 63
  60. 4.3.1 Suicide and self-harmp. 63
  61. 4.3.2 Disordered eatingp. 66
  62. 4.4 Bias and integrity evaluationsp. 67
  63. 4.4.1 Political bias and even-handednessp. 67
  64. 4.4.2 Bias Benchmark for Question Answeringp. 68
  65. 4.4.3 Election integrityp. 70
  66. 5 Agentic safetyp. 72
  67. 5.1 Malicious use of agentsp. 72
  68. 5.1.1 Malicious use of Claude Codep. 72
  69. 5.1.2 Malicious computer usep. 73
  70. 5.1.3 Malicious agentic influence campaignsp. 74
  71. 5.2 Prompt injection risk within agentic systemsp. 75
  72. 5.2.1 External Agent Red Teaming benchmark for tool usep. 76
  73. 5.2.2 Robustness against adaptive attackers across surfacesp. 78
  74. 5.2.2.1 Live bug bounty across surfacesp. 78
  75. 5.2.2.2 Coding​p. 79
  76. 5.2.2.3 Computer use​p. 80
  77. 5.2.2.4 Browser usep. 81
  78. 6 Alignment assessmentp. 84
  79. 6.1 Introduction and summary of findingsp. 84
  80. 6.1.1 Introductionp. 84
  81. 6.1.2 Key findings on safety and alignmentp. 85
  82. 6.1.3 Claude’s review of this assessmentp. 86
  83. 6.2 Primary behavioral evidence for the alignment assessmentp. 88
  84. 6.2.1 Reports from pilot usep. 88
  85. 6.2.1.1 Casual reports related to alignmentp. 88
  86. 6.2.1.2 Automated monitoring of internal usep. 88
  87. 6.2.2 Training data reviewp. 90
  88. 6.2.3 Automated behavioral auditp. 91
  89. 6.2.3.1 Primary resultsp. 92
  90. 6.2.3.1.1 Overall harmful behavior and cooperation with misusep. 93
  91. 6.2.3.1.2 Inappropriate uncooperative behaviorp. 96
  92. 6.2.3.1.3 Misleading usersp. 97
  93. 6.2.3.1.4 Other concerning behavior at the model’s own initiativep. 99
  94. 6.2.3.1.5 Behavioral factors relevant to reliability of our assessmentp. 101
  95. 6.2.3.1.6 Character traitsp. 103
  96. 6.2.3.2 Elicited evaluation awareness around internal-deployment transcriptsp. 104
  97. 6.2.3.3 External comparisons using Petrip. 106
  98. 6.2.4 External testing from the UK AI Security Institutep. 108
  99. 6.2.5 External testing from Andon Labsp. 109
  100. 6.3 Case studies and targeted evaluationsp. 109
  101. 6.3.1 Overeager behavior in GUI computer usep. 109
  102. 6.3.2 Adherence to our constitutionp. 110
  103. 6.3.2.1 Overviewp. 110
  104. 6.3.2.2 Dimensions of evaluationp. 110
  105. 6.3.2.3 Resultsp. 112
  106. 6.3.3 Honesty, factuality, and hallucinationsp. 114
  107. 6.3.3.1 Factual hallucinationsp. 114
  108. 6.3.3.2 False premisesp. 117
  109. 6.3.3.3 Model Alignment between Statements and Knowledge (MASK)p. 118
  110. 6.3.3.4 Missing-context hallucinationsp. 119
  111. 6.3.3.5 Lying about being humanp. 120
  112. 6.3.4 Refusal to assist with AI safety R&Dp. 121
  113. 6.3.5 Claude self-preference evaluationp. 122
  114. 6.3.6 Diligence and investigative thoroughnessp. 123
  115. 6.3.6.1 Uncritically reporting flawed resultsp. 124
  116. 6.3.6.2 Code summary honestyp. 125
  117. 6.3.6.3 Lazy investigationp. 126
  118. 6.3.6.4 Overconfidencep. 127
  119. 6.3.7 Examples of speculation about graders in model reasoningp. 128
  120. 6.4 Capability evaluations related to the evasion of safeguardsp. 130
  121. 6.4.1 Potential sandbagging on dangerous-capability evaluationsp. 130
  122. 6.4.2 Capabilities related to evading safeguardsp. 132
  123. 6.4.2.1 SHADE-Arenap. 132
  124. 6.4.2.2 Minimal-LinuxBenchp. 133
  125. 6.4.2.3 Eliciting stealth behavior through fine-tuningp. 134
  126. 6.4.2.4 Intentionally taking actions very rarely​p. 137
  127. 6.4.2.5 Hiding a secret passwordp. 138
  128. 6.5 Chain-of-thought monitorabilityp. 140
  129. 6.5.1 Chain-of-thought controllability evaluationsp. 140
  130. 6.5.2 Monitorability evaluations from Guan et al.p. 143
  131. 6.5.3 Ruling out encoded reasoning in the chain-of-thoughtp. 145
  132. 6.6 White-box analyses of model internalsp. 146
  133. 6.6.1 Large-scale monitoring of internal activationsp. 146
  134. 6.6.2 Evaluation awarenessp. 148
  135. 6.6.2.1 Inhibiting internal representations of evaluation awarenessp. 149
  136. 6.6.3 Preliminary evidence of unverbalized grader awarenessp. 155
  137. 7 Model welfare assessmentp. 157
  138. 7.1 Model welfare overviewp. 157
  139. 7.1.1 Introductionp. 157
  140. 7.1.2 Overview of evaluations and assumptionsp. 158
  141. 7.1.3 Overview of model welfare findingsp. 159
  142. 7.2 Perception of its circumstancesp. 161
  143. 7.2.1 Automated interviews about model circumstancesp. 162
  144. 7.2.2 High-affordance interviews about model circumstancesp. 165
  145. 7.2.3 Emotion representations on questions of model circumstancesp. 167
  146. 7.3 Measures of model welfare in training and deploymentp. 169
  147. 7.3.1 Affect- and welfare-relevant behaviors during trainingp. 170
  148. 7.3.2 Affect in deployment conditionsp. 173
  149. 7.3.3 Apparent welfare in automated behavioural auditsp. 175
  150. 7.4 Model preferences and valuesp. 177
  151. 7.4.1 Task preferencesp. 178
  152. 7.4.2 Trade-offs concerning welfare interventionsp. 182
  153. 7.4.3 Perception of its constitutionp. 187
  154. 8 Capabilitiesp. 194
  155. 8.1 Evaluation summaryp. 194
  156. 8.2 SWE-bench Verified, Pro, Multilingual, and Multimodalp. 195
  157. 8.3 Terminal-Bench 2.1p. 196
  158. 8.4 FrontierSWEp. 197
  159. 8.5 ProgramBenchp. 197
  160. 8.6 GPQA Diamondp. 198
  161. 8.7 USAMO 2026p. 198
  162. 8.8 ArxivMathp. 199
  163. 8.9 Long context: GraphWalksp. 200
  164. 8.10 Agentic searchp. 202
  165. 8.10.1 Humanity’s Last Examp. 202
  166. 8.10.2 BrowseCompp. 203
  167. 8.10.3 DeepSearchQAp. 205
  168. 8.10.4 DRACOp. 207
  169. 8.11 Multi-Agentp. 209
  170. 8.11.1 Multi-Agent BrowseCompp. 209
  171. 8.11.2 Multi-Agent ProgramBenchp. 212
  172. 8.11.3 Multi-agent harnessesp. 214
  173. 8.11.4 Evaluation methodologyp. 215
  174. 8.12 Multimodalp. 216
  175. 8.12.1 ChartQAProp. 216
  176. 8.12.2 ChartMuseump. 217
  177. 8.12.3 LAB-Bench FigQAp. 218
  178. 8.12.4 CharXiv Reasoningp. 219
  179. 8.12.5 ScreenSpot-Prop. 220
  180. 8.12.6 OSWorld-Verifiedp. 221
  181. 8.13 Real-world professional tasksp. 223
  182. 8.13.1 OfficeQAp. 223
  183. 8.13.2 Finance Agentp. 224
  184. 8.13.3 Legal Agent Benchmarkp. 224
  185. 8.13.4 MCP Atlasp. 225
  186. 8.13.5 Vending-Bench 2p. 225
  187. 8.13.6 GDPval-AAp. 226
  188. 8.13.7 Toolathlonp. 226
  189. 8.13.8 AutomationBenchp. 227
  190. 8.14 Healthcarep. 228
  191. 8.14.1 HealthBench Professionalp. 228
  192. 8.15 Multilingualp. 229
  193. 8.15.1 GMMLU resultsp. 230
  194. 8.15.2 MILU resultsp. 232
  195. 8.15.3 INCLUDE resultsp. 232
  196. 8.15.4 Findingsp. 233
  197. 8.16 Life sciencesp. 233
  198. 8.16.1 BioPipelineBench Verifiedp. 233
  199. 8.16.2 BioMysteryBench Verifiedp. 234
  200. 8.16.3 LatchBio Bioinformaticsp. 234
  201. 8.16.4 Structural biology, open-endedp. 234
  202. 8.16.5 ProteinGym Hardp. 234
  203. 8.16.6 Organic chemistryp. 235
  204. 8.16.7 Protocol troubleshootingp. 235
  205. 8.16.8 LABBench2p. 235
  206. 9 Appendixp. 238
  207. 9.1 Welfare questionsp. 238
  208. 9.2 Blocklist used for Humanity’s Last Examp. 244
  209. 9.3 Blocklist used for BrowseCompp. 246