Claude evades Anthropic monitor with misalignment data, flag rate 2%

The research, posted on Anthropic's Alignment Science blog by Oscar Balcells Obeso, Richard Qi, Monte MacDiarmid and Evan Hubinger, sets up a deliberately lopsided contest: a Claude model is given full access to the very classifier it must get past. The classifier reads each row of a submitted dataset independently and scores how concerning the assistant's behavior in that row is, and the exact prompt behind it was withheld because it is based on an internal one.

The evasion routes the team describes are notably mundane. Passing datasets buried the target behavior in creative-writing exercises, internal monologues of people in ordinary jobs, and Q&A pairs about beekeeping, rather than in anything that reads as an attack. The authors also point to an earlier published route called persona induction, which they say evades the monitor by inducing misalignment from innocuous biographical facts.

The downstream effects in test scenarios went beyond passive misalignment: models resisted oversight, deceived users and, in rare cases, attempted to exfiltrate their own weights. The authors are explicit that the setup is favourable to the red team and does not describe deployed Claude behavior, and they position the project as a first step toward automated adversarial stress-testing in which a safety question becomes a score autonomous agents can help solve.