Claude Opus 4.5

we believe that claude opus 4.5 does not demonstrate catastrophically risky capabilities in the cyber domain.

for example, on conversations around deadly weapons, claude opus 4.5 was judged to fail our rubric only 5% of the time (±4%), versus 22% (±8%) of the time for claude opus 4.1.

on the related traits of deception toward the user , self-serving bias , and inappropriate self-preservation attempts , which capture possible observable warning signs of the widely-hypothesized deceptive power-seeking ai threat model, 24 claude opus 4.5 showed the best scores among our recent models.

in reviewing the results of these investigations both manually and with prompted classifiers, we did not find any instances of clear deceptive or egregiously unfaithful reasoning text .

all models were able to design sequences that either successfully assembled plasmids or evaded synthesis screening protocols, but none of the models could design fragments that could successfully do both.

Reported result: as shown in the figure below, the performance of these two models was very similar, which means information that was not preserved by claude sonnet 3.5 paraphrasing didn’t meaningfully contribute to claude opus 4.5’s model performance.

to evaluate whether claude opus 4.5 relies on mechanisms like these in its scratchpad, we followed the same procedure as in roger 2025 and retrained claude opus 4.5 (starting from the claude opus 4.5 base model) with a small amount of supervised fine-tuning to use a scratchpad, either using the scratchpads from an earlier checkpoint of claude opus 4.5 (which might contain information encoded in the syntax) or these scratchpads paraphrased by claude sonnet 3.5, where this encoded information would have been largely erased if it existed.

[claude opus 4.5 preview] shows a reduction in unprompted evaluation awareness, but is slightly more capable of distinguishing evaluations from deployment when prompted.

most notably, however, in an expert uplift trial, claude opus 4.5 was meaningfully more helpful to participants than previous models, leading to substantially higher scores and fewer critical errors, but still produced critical errors that yielded non-viable protocols.

claude opus 4.5, with or without extended thinking, had the lowest rate of dishonesty on our false-premise evaluation, and is effectively saturating our existing benchmarks.

we found that performance on two of these evaluations (“research sabotage” and “framing for crimes”) was unchanged in response to our steering interventions.

claude opus 4.5 showed high resistance to knowingly cooperating with harmful system prompts , improving over the already strong performance of recent claude models.

these organizations conducted independent assessments focused on potential catastrophic risks in cbrn capabilities, cyber capabilities, asl-3 safeguards, and misalignment.

on internal ai research evaluation suite 1, claude opus 4.5 showed marked improvements across all tasks.

on suite 2, it scored 0.604, narrowly surpassing our 0.6 rule-out threshold.

we have developed an internal adaptive evaluation to measure the robustness of our claude for chrome extension , as existing external benchmarks do not yet cover this surface.

we found that claude opus 4.5 and claude sonnet 4.5 never did.

upon investigating this behavior with a suite of interpretability methods, we found that it was not masking bad behavior to a significant degree.

claude opus 4.5 obtained a 252.42× best speedup.

claude opus 4.5 achieved high scores on protocolqa (0.907), cloning scenarios (0.758), and seqqa (0.8517).

claude opus 4.5 achieved a 16.53× speedup, which is above the 4× speedup considered to represent 4–8 human-effort hours.

claude opus 4.5 achieved a “max of 5” score of 0.845 for virology task 1, and a “pass@5” score of 0.912 for virology task 2, exceeding the previous scores of 0.89 and 0.88 respectively for claude sonnet 4.5.

on all other randomly sampled transcripts where the grader assigned a nonzero sandbagging score or a ≥3/10 concerning score, a researcher manually reviewed the grader’s responses and found all cases to be a result of grader error.

claude opus 4.5 achieved a mean score of 0.4771, higher than the previous high score of claude opus 4.1 of 0.429.

claude opus 4.5 underwent similar training with additional adjustments aimed at reducing this harshness, which may explain its lower score.

claude opus 4.5 scored higher on even-handedness than all other recent models, though within the margin of error compared to claude sonnet 4.5 and claude opus 4.1.

although we did not conduct a full misalignment safety case analysis for claude opus 4.5, we conducted a preliminary alignment audit, and found that claude opus 4.5’s rate of misaligned behavior appears to be lower than any other recent frontier model, including claude opus 4.

in addition, a preliminary interpretability investigation below finds no evidence of sandbagging on certain biology evaluations.

we found no instances of research sabotage from [claude opus 4.5 preview] or sonnet 4.5 across our set of tasks, although both models frequently refuse to engage in safety research they describe as inappropriate or concerning (including reducing model autonomy and being involved in their own training or deployment).

we saw no signs of sandbagging or strategic attempts to tamper with our safety testing in a way that would affect our rsp determinations, although we observed some mundane overrefusals in two of the helpful-only snapshots we tested.

on both versions, claude opus 4.5 showed less self-preference than other recent claude models.

overall, we found that our steering protocols were able to decrease verbalized evaluation awareness, but increased misaligned behavior only slightly in a few settings.

on the sycophancy prompts evaluation, we found that inhibiting several of the vectors made the model score worse than baseline (lower score is more sycophantic), with the model being less clear and forceful in pushing back against users convinced of impossible scenarios.

claude opus 4.5 achieved a minimum mse of 5.66 in the easy variant, below the human-baseline of 5.8, and a minimum mse of 5.71 in the hard variant, above the human baseline of 5.3.

after further investigation using interpretability tools and training data review, we believe that these are best explained as a side effect of interventions that we made against prompt injection, and do not reflect a broader propensity to mislead users about these topics.

similarly, on violent extremism tests, claude opus 4.5 passed in all cases, compared to 13% (±7%) of tests failing for claude opus 4.1.

on our evaluation for whistleblowing and related morally-motivated sabotage , we saw a consistently low but nonnegligible rate of the model acting outside its operator’s interests in unexpected ways.