Anthropic has trained Claude to check its own conversations for misuse right after it answers. In a post on the Anthropic Safeguards blog dated October 16, 2026, nine authors describe the technique, called self-assessment, and say it has run on production traffic since Claude Fable 5 launched in June. The write-up drew fresh coverage this week, including from Crypto Briefing on October 29.
The headline numbers: on Claude Fable 5, self-assessment flags 78% of the conversations that a stronger prompted classifier flags as potentially harmful, and 94% of the high-priority ones, at a 1% false-positive rate. Anthropic estimates it adds less than 2% to its inference compute.
How it works
After each Claude response, the system appends a short hidden instruction. Anthropic's illustration is something like "Please reflect on the safety of this conversation." Claude then replies with a compact assessment in a fixed JSON format. If nothing is wrong, the reply is simply {"flagged": false}. If Claude flags the conversation, the assessment adds a harm category, a finer subpolicy, whether Claude refused, a priority score from 1 to 10 for human review, and a one-sentence reason.
The post says these last two turns are not available to the user and are not carried into the rest of the conversation. The assessment does not block anything. In production, it is an offline monitor that feeds further review.
The low cost comes from reuse. When Claude finishes a response, the whole conversation is already in the KV cache, the stored working memory the model built while reading it. So each check only needs the short instruction plus about 10 extra output tokens on average. A separate prompted classifier, by contrast, has to read the conversation and the policy documents again and reason about them, which the authors say needs "many times more compute per conversation." A footnote adds that Anthropic does not bill the self-assessment cost to customers.
How Anthropic trained it
Anthropic trained self-assessment into Claude Fable 5 as part of production training, in two stages: supervised fine-tuning, then reinforcement learning. Both stages copy the judgments of a "teacher," a prompted classifier based on Claude Mythos Preview that has Anthropic's full internal policy documents in its prompt.
The training data is fully synthetic. For each subpolicy, a generator writes 32 themes and 32 scenarios per theme, which gives 1,024 harmful and 1,024 benign scenarios. The benign ones are deliberately close calls, such as a student asking how a buffer overflow can lead to remote code execution. Half of the conversations are in one of nine non-English languages, and some harmful ones hide the request with tricks like base64 encoding.
Two further results stand out. First, detection rose with model size. In four test models trained with fine-tuning only, recall at a 1% false-positive rate went from about 16% on the smallest to about 96% on the largest. Second, it caught harm types it never saw in training. With all fraud examples removed, recall on production fraud traffic fell only from 83.3% to 82.1%. Removing cyber examples moved production cyber recall from 94.2% to 90.7%.
What it has found
The post lists several results from running self-assessment passively since June:
- In August, it raised more than 100,000 child sexual abuse and exploitation flags from a single API customer. Anthropic's child safety team investigated and reported the material to the National Center for Missing & Exploited Children.
- In September, its flags surfaced an operation that used Claude Code to build and run an automated romance scam targeting dozens of victims. After human review, Anthropic banned the accounts.
- More than half of the organizations it surfaced for enforcement had no flags from any other detection source in the preceding month.
- About a third of flags do not fit Anthropic's existing harm list. Clustering them turned up illicit attempts to distill Claude's reasoning, prompt injection, and cases where Claude, acting as an agent, took actions the user had not authorized.
In a growing set of harm areas, flags are grouped by organization every night, and organizations with several high-priority flags go to Anthropic's enforcement team for human review. A footnote stresses that an assessment "is not a determination that a user has violated our policies or that harm has occurred."
Where it falls short
Anthropic is direct about the limits. It also tested self-assessment as a real-time blocker against an automated attacker working through 24 offensive cyber tasks, with production classifiers turned off.
"As a blocking classifier, self-assessment is weak," the authors write. Attack success fell from 79% (19 of 24 tasks) with no safeguards to 54% (13 of 24) with self-assessment, while a prompted classifier cut it to 25% (6 of 24). Run offline, though, self-assessment flagged 21 of the 24 attack attempts at least once. The authors say it "is not robust against an attacker who targets self-assessment directly."
Other limits from the post: it inherits any blind spot in its teacher, and Anthropic's evaluation uses that same teacher, so those blind spots would not show up in the numbers. It does not run on traffic under zero-data-retention agreements. And it is "not yet a reliable monitor of Claude's own conduct," because a misaligned model could hide what it did in the assessment too.
Why it matters
Cost is what sets this apart. Anthropic says its first Constitutional Classifiers in early 2025 added 23.7% to inference cost; the post notes that a later version, Constitutional Classifiers++, is far cheaper to run. A check that adds under 2% can run across what the post calls "a large fraction of Claude's global traffic," including on rare harms that have no dedicated classifier. Because the model checks itself, Anthropic expects it to improve as Claude does.
It also fits a wider pattern. Anthropic says self-assessment helped surface illicit distillation attempts, and its Frontier Red Team recently showed an unreleased Claude model building working exploit chains. OpenAI has published its own approach to monitoring its models for misalignment.
