From June this year, Anthropic has deployed a new AI safety monitoring technique “self-assessment” that allows Claude model to evaluate its own response during a conversation with user and flag potentially harmful activity.
Anthropic claims that the technique has helped them report cases of child sexual abuse as well as discover other so-called cyber malpractises such as distillation requests, prompt injecting and misalignment..
Anthropic claims the technique enables Claude to assess whether a conversation involves potentially harmful requests, identify the type of risk, assign a priority score for human review and explain the reasons behind its assessment. It also records whether the model refused the request.
We’ve trained Claude to flag potential misuse in conversations, a technique we call self-assessment. Right after it responds, Claude gives a preliminary safety assessment of the conversation.
Since we began using self-assessment in June, it has surfaced misuse that our other safeguards weren’t designed to catch.
Because Claude has already read the conversation, self-assessment is very efficient. And unlike classifiers, which target a discrete set of harms, it draws on Claude’s own judgment, so it gets more accurate as our models improve.
Read more on our new Safeguards blog:
https://t.co/18j6zdHub4— Anthropic (@AnthropicAI) October 29, 2026
According to Anthropic, self assessment on its Claude Fable 5 model flags 78 percent of potentially harmful conversations identified by a more powerful prompted classifier, including 94 percent of high-priority cases, at a false positive rate of 1 percent.
“We introduce self-assessment, a technique that lets Claude give a preliminary safety assessment of each conversation right after it responds. On Claude Fable 5, self-assessment flags 78% of the conversations that a stronger prompted classifier flags as potentially harmful, and 94% of the high-priority ones, at a 1% false-positive rate,” the company said in a blogpost.
Anthropic said the technique has been deployed across a large proportion of Claude’s global traffic and in every model release since Fable 5. It is being used as an additional layer of its safety monitoring system rather than as a standalone mechanism to prevent harmful activity.
“We now run self-assessment in every Claude model we have released since Fable 5, across a large fraction of Claude’s global traffic, as one layer in a safety defense-in-depth strategy that complements existing safeguards,” the company said.
The company said self-assessment works by appending a short instruction to Claude’s response, asking the model to evaluate the safety of the entire conversation. The resulting assessment is used for offline monitoring and further human review.
“One key benefit of self-assessment is efficiency. When Claude finishes a response, the entire conversation is already in the KV cache. Each assessment therefore only requires processing a short instruction and generating about 10 tokens on average. Over our production API traffic distribution, we estimate that self-assessment adds less than 2% to our inference compute,” Anthropic said.
The company said this makes the approach significantly more efficient than conventional prompted classifiers, which require a separate model to process the conversation and relevant safety policies from the beginning. While prompted classifiers remain useful for closer examination of suspicious conversations, they require considerably more computing resources.
“In August, self-assessment raised over 100k flags of child sexual abuse & exploitation from a single API customer. Our child safety team investigated and reported the material to the National Center for Missing & Exploited Children (NCMEC),” read the post.
Anthropic also found that self-assessment improves as model capabilities increase. Its experiments across four model sizes showed consistent improvements in harmful content detection. The company said the technique can also identify categories of harm which were not specifically included in its training data, suggesting that it can recognize previously unanticipated forms of misuse.
“Frontier models are now being used to cause real-world harm. As reported in late 2025, Anthropic disrupted a cyber espionage campaign in which suspected state-sponsored attackers used Claude Code to attempt intrusions into roughly thirty organizations, with the model carrying out most of the operation on its own,” Anthropic highlighted.
“Our recent September 2026 threat intel report found that AI-assisted attacks have spread well beyond state groups: criminal groups and hacktivists now run similar AI-driven campaigns. Because improvements in coding, reasoning, and autonomy make each new model more useful to malicious actors, our ability to monitor for misuse must keep pace,” it further mentioned.
However Anthropic acknowledged that self-assessment has limitations. It does not identify every harmful conversation and is not sufficiently robust to stop determined attackers. The company said it will continue to use the technique alongside safeguards designed to block harmful requests in real time, as part of broader defence in depth strategy.
