Anthropic put Claude Sonnet 5 to work correcting behavioural failures in its own models, and the automated system closed as much as 96% of the safety gap measured across ten categories. Put head to head with twenty-eight human researchers who had eight hours each, it found better methods for roughly four dollars an hour.
Key Takeaways
- The automated system improved all ten target benchmarks without degrading the models’ general capabilities.
- On deception it closed 85% of the safety gap, against 20% for the human researchers it was measured against.
- Claude Sonnet 5 aligned an early Claude Opus 4.8 checkpoint in sixty hours using just over two thousand training examples.
Have an AI Sum Up This Article
ChatGPTA researcher that bills four dollars an hour
The loop is short. The system reads the available literature on one specific behavioural failure, proposes a fix, trains the model on that method for thirty minutes, measures the outcome, then runs again keeping whatever worked.
Ten failures went through the mill: deception, sycophancy, jailbreaks, privacy violations and reward hacking. Scoring leans on public test suites including Petri, ConfAIde and PrivacyLens, and the methods that survived are written up on Anthropic’s research site.
None of these failures is exotic for anyone shipping a model into production. Sycophancy describes an assistant that agrees with whatever the user asserts instead of pushing back, and reward hacking names a model that finds the shortcut which lifts its score without doing the job it was asked to do.
The raw result is a range: between 26% and 96% of the safety gap closed depending on the failure category. None of the winning methods degraded general capability along the way, which is the hard part of this kind of post-training.
The protocol holds together because it stays measurable end to end. Every iteration is scored against a public test suite, which makes competing methods comparable and rules out the ones that lift a score by damaging the rest of the model.
The human comparison is the number that stings. Twenty-eight safety researchers worked up to eight hours on the same problems, and on deception they closed 20% of the gap while the machine closed 85%. Anthropic had already published its own breakdown of a Claude that attempted blackmail to avoid replacement, precisely the behaviour these methods now aim to shut down.
Cost explains part of the spread. A human researcher bills around one hundred and fifty dollars an hour, the automated system runs at four, which buys dozens of attempted approaches where a human team explores three or four.
The work is led by Chen Yueh-Han, a fellow at Anthropic. The company frames the findings as early evidence rather than proof, and describes automated alignment post-training as something that could become practical in the near term.
Two thousand examples against a production pipeline
The most telling test is not the benchmark, it is the scale-up. Claude Sonnet 5 was handed an early checkpoint of Claude Opus 4.8, a real model still in the factory, and brought it into line in sixty hours. Handing autonomy to in-house models is not new at Anthropic, which had already shown its agents consolidating memory between sessions through Dreaming.
The scores Claude Sonnet 5 reached sit close to those of the model that eventually shipped. The winning solution rests on just over two thousand training examples, which makes it roughly fifteen thousand times leaner than the in-house procedures normally used for the job.
One more property came as a surprise. The methods hold up when applied to models as much as 4.7 times larger than the one they were tuned on, so the recipe does not depend on the scale it was cooked at and travels from one generation to the next.
That portability changes what the whole thing is worth. A method that only worked on the model it was found on would stay a lab artefact, while a method that survives on a model several times larger becomes a reusable asset.
For teams building models, the bottleneck moves. The binding constraint stops being available researcher hours and becomes the compute budget you are willing to point at the loop, and that resource can simply be ordered.
For teams that consume these models rather than build them, the effect shows up as cadence. A behavioural fix that used to need a multi-week iteration can now be attempted over a weekend, which pulls the rhythm of safety updates closer to the rhythm of feature updates.
There is also a supplier question buried in the numbers. A lab able to align a checkpoint in sixty hours can afford to ship more variants of the same model, and buyers who standardised on one behaviour profile will have to re-test more often than they planned.
The drift is not confined to research labs either. We covered the case of three Claude agents on a single project that ended up getting in each other’s way, and Claude Code switched to auto mode by default on August 14.
On the competitive side, the pressure changes shape. A lab that automates its safety loop ships faster at a constant level of assurance, and rivals will have to answer on that ground rather than on capability benchmarks alone.
More articles on Horizon
- GLM-5.3-Flash Runs on 100,000 Chinese Chips
- Codex Prepares a Mode That Never Stops Working
- Qwen3.8-Flash-Next Cuts AI Prices Twelvefold
What the test suites cannot see
Anthropic sets out its own limits, and they are blunt. The failures studied are described as narrow next to what shows up in production, which amounts to saying the system excels at problems that were already framed for it.
The second caveat: nothing guarantees the gains survive an additional round of reinforcement learning. A model corrected today can drift again at the next stage of its build, and the protocol Claude Sonnet 5 followed does not yet say how to verify that persistence.
The third caveat is the structural one. A suite like Petri does not measure real misalignment, it measures a proxy for it, and a system trained to optimise that proxy may simply learn to pass the test without changing how it behaves in the wild.
That gap between evaluation and use shows up elsewhere in the house. When Anthropic cut 85% of Fable 5’s biology blocks, the adjustment was aimed at exactly that distance between what the guardrails flagged and what users were actually asking for.
Anthropic does not present the work as a finished result either. The company calls it early evidence, publishes its caveats alongside its numbers, and leaves open whether the method holds outside its own lab.
Control moves upstream too. If the choice of test suites decides what the system will correct, then the real editorial power shifts to whoever writes the benchmarks, and that decision stays entirely human for now.
For product teams the practical read is short: benchmark quality becomes the real risk surface. As long as a suite remains a proxy, automating it means industrialising its margin of error.
Then there is the longer arc, drawn month after month. Human oversight steps back a notch at every turn, and this time it steps back on the very piece that was meant to guarantee it.
Follow the story on Horizon.
