Claude becomes its own supervisor. But can an AI be trusted to judge itself?

Anthropic asks Claude to evaluate the risks of its own conversations. A discreet, low-cost monitoring system, but still vulnerable to attacks.

You ask Claude a question, it responds, and then quietly reviews the conversation to determine whether anything about it raises a safety concern. This second assessment, invisible to the user, allows the model to identify potentially harmful requests, categorize the risks involved, and flag conversations that may warrant further investigation. Anthropic calls the technique self-assessment. Its defining feature is straightforward: rather than always relying on a separate AI system to monitor conversations, the company asks Claude to evaluate the exchange it just participated in.

The approach is already running across a large share of Claude's global traffic. In a research paper published by its safety team, Anthropic reports that Claude Fable 5 identifies 94% of conversations classified as high priority by a more powerful reference system, while maintaining a 1% false-positive rate. The additional computational cost is estimated at less than 2%. But the researchers also acknowledge a fundamental weakness: when an attacker deliberately targets the monitoring mechanism, its effectiveness drops significantly. A Second Response Nobody Sees

The system works by adding an extra step after Claude completes its response. Once the regular exchange has ended, the model receives an instruction asking it to reflect on the conversation's safety. This operation takes place separately from the interaction visible to the user and does not change the answer already provided. Claude produces a structured assessment indicating whether the discussion presents a potential risk, what category that risk falls into, and whether human intervention may be necessary.

When a conversation is flagged, the system also records whether Claude refused the original request, assigns a priority score between 1 and 10, and generates a brief explanation. It can therefore distinguish an explicitly harmful exchange from a more ambiguous situation, or identify a problematic request even when the model correctly refused to comply. These assessments feed additional monitoring processes, including investigations and the aggregation of alerts by organization.

The technical advantage comes from reusing information Claude has already processed. By the time the model performs its self-assessment, the conversation is still available in its temporary computational memory, known as the KV cache. That eliminates the need to send the entire exchange to another model for a second analysis. According to Anthropic, the assessment requires an average of roughly ten additional tokens and increases inference compute by less than 2% across the traffic distribution it studied.

At scale, that efficiency matters. The most capable safety classifiers typically need to reread conversations, consult detailed policies, and perform their own reasoning. Those operations become expensive when applied to millions of exchanges. Self-assessment gives Anthropic a relatively inexpensive initial warning signal, allowing more demanding investigations to focus on conversations that actually warrant closer attention. Strong Detection Rates, but Another AI Sets the Standard

To evaluate the technique, Anthropic used a sample of real production conversations assessed by a reference classifier based on Claude Mythos Preview. That system had access to the company's internal safety policies and detailed instructions for identifying potentially harmful uses. Its judgments were then compared with the assessments generated directly by Claude Fable 5.

At a false-positive rate of 1%, self-assessment identified 78% of conversations flagged by the reference model. For situations classified as high priority, defined as a score of at least 7 out of 10, recall reached 94%. Performance was lower for less serious cases, but the results remain notable given the technique's relatively small computational overhead.

Those numbers require some perspective. They do not mean Claude detects 94% of every possible instance of harmful use. They measure how often it agrees with another Anthropic model acting as the reference evaluator. The researchers explicitly acknowledge this limitation: if the reference system fails to recognize a dangerous situation, an evaluation based on its judgments may reproduce the same blind spot.

A separate experiment suggests that self-assessment improves as models become more capable. Across four differently sized architectures trained under a distinct protocol, recall increased from approximately 16% for the smallest model to 96% for the largest, again at a 1% false-positive rate. The findings suggest that stronger models could also become better at detecting safety risks in conversations. However, these figures cannot be directly compared with the production results reported for Fable 5. Recognizing Threats That Were Never Explicitly Taught

One of Anthropic's goals is to move beyond safety systems trained to recognize narrowly defined categories of harmful behavior. A classifier built around specific examples can perform well within its intended domain while struggling with new threats or unusual ways of presenting familiar risks. Self-assessment attempts to overcome that limitation by drawing on the model's broader understanding of the conversation.

The researchers tested this capability by deliberately removing all training examples belonging to a particular harm category, then measuring whether the model could still recognize that category afterward. For fraud-related synthetic conversations, recall declined from 92.8% to 90% when the relevant examples were excluded from self-assessment training. For cybersecurity risks, it fell from 92.7% to 90.3%. Similar patterns appeared in the production-traffic samples used for these experiments.

The relatively small decline suggests that Claude is doing more than memorizing examples. It appears to draw on its general knowledge to recognize potentially dangerous situations, even when they were not explicitly represented in the