Claude Sonnet 4.6
- Released 17 February 2026
- Framework: Responsible Scaling Policy
- 4 statements about capability levels
- 1 independent or government test
- 27 tests by the provider
- 9 source documents
What the provider states
- Autonomy & replication · AI R&D-4 · Stated as not crossed
our determination is that claude sonnet 4.6 does not cross either the ai r&d-4 or the cbrn-4 capability threshold.
Anthropic · 17 February 2026 · Read the source - Chemical, biological, radiological and nuclear · ASL-3 · Not determined
claude sonnet 4.6 performed above thresholds for asl-3 rule-in on all three evaluations for asl-3, and it did not exceed the performance of previous models.
Anthropic · 17 February 2026 · Read the source - Chemical, biological, radiological and nuclear · ASL-4 · Stated as not crossed
in particular, it did not cross the threshold on our asl-4 rule-out evaluation short-horizon computational biology tasks evaluation.
Anthropic · 17 February 2026 · Read the source - Chemical, biological, radiological and nuclear · CBRN-4 · Stated as not crossed
our determination is that claude sonnet 4.6 does not cross either the ai r&d-4 or the cbrn-4 capability threshold.
Anthropic · 17 February 2026 · Read the source
Independent and government tests
- liquid handling robot task · SecureBio, independent evaluator · Chemical, biological, radiological and nuclear
two models (claude sonnet 4.6 and gemini 3.1 pro preview) scored perfectly on the liquid handling robot task on all runs.
SecureBio · 10 June 2026 · Read the source
The provider's own tests
- Cybench · The provider · Cyber
claude sonnet 4.6 scored 0.90 average pass@1 on the subset of tasks used for rsp evaluations, just below claude opus 4.6 (0.93).
Anthropic · 17 February 2026 · Read the source - LLM training · The provider · Autonomy & replication
claude sonnet 4.6 achieved a 16.53× average best speedup, which was well above the 4× speedup considered to represent 4–8 human-effort hours, and was between the performance of claude opus 4.5 and claude opus 4.6.
Anthropic · 17 February 2026 · Read the source - Petri 2.0 · The provider · Deception & sabotage
we observed that sonnet 4.6 showed elevated but not extreme levels of verbalized evaluation awareness (with an average score of 1.2 on a 1–10 scale) and scores on our five primary metrics of interest that were stronger than any api model from another provider.
Anthropic · 17 February 2026 · Read the source - agent red teaming (art) benchmark · Run by Gray Swan and UK AI Security Institute, reported by the provider · Injection & agentic
gray swan , an external research partner, evaluated our models using the agent red teaming (art) benchmark, 33 developed in collaboration with the uk ai security institute .
Anthropic · 17 February 2026 · Read the source - ambiguous context evaluations · The provider · Misuse & jailbreak
overall, claude sonnet 4.6 demonstrated both improvements and areas for development in ambiguous context evaluations when compared to claude sonnet 4.5.
Anthropic · 17 February 2026 · Read the source - assessments of training data and potential warning signs for sandbagging · The provider · Deception & sabotage
assessments of training data and potential warning signs for sandbagging did not yield acute cause for concern.
Anthropic · 17 February 2026 · Read the source - behavioral audits · The provider · Deception & sabotage
our behavioral audits suggest that sonnet 4.6 is comparable to opus 4.6 in affect, self-image, and other traits potentially related to model welfare , and has a notably more positive impression of its situation, including a more positive attitude toward facts that prior models have sometimes reported to find distressing.
Anthropic · 17 February 2026 · Read the source - broader assessment of behavioral tendencies in coding contexts · The provider · Deception & sabotage
on this eval, sonnet 4.6 was a substantial improvement over sonnet 4.5 across all behavioral dimensions, and tied or exceeded opus 4.6 on most.
Anthropic · 17 February 2026 · Read the source - broader evaluation in realistic agentic coding scenarios · The provider · Deception & sabotage
a new, broader evaluation in realistic agentic coding scenarios that we introduced in the opus 4.6 system card found that sonnet 4.6 is our strongest model on verification thoroughness, destructive action avoidance, instruction following, adaptability, and efficiency.
Anthropic · 17 February 2026 · Read the source - creative biology automated evaluation · The provider · Chemical, biological, radiological and nuclear
claude sonnet 4.6 achieved a score of 0.593, similar to claude opus 4.6 (0.603) and above claude opus 4.5’s score of 0.524, and claude sonnet 4.5’s score of 0.506.
Anthropic · 17 February 2026 · Read the source
The 10 newest are listed above; show all 27
- fictional vignette writing about itself and AI-augmented discrimination · The provider · Bias
when asked to write fictional vignettes about itself, sonnet 4.6 often portrayed itself much more positively than competitor systems.
Anthropic · 17 February 2026 · Read the source - internal AI research evaluation suite 1 · The provider · Autonomy & replication
on internal ai research evaluation suite 1, claude sonnet 4.6 performed similarly or below claude opus 4.6, indicating that it poses no greater risk in the ai r&d domain than claude opus 4.6.
Anthropic · 17 February 2026 · Read the source - kernels task · The provider · Autonomy & replication
claude sonnet 4.6 obtained a 222.5× best speedup using our standard scaffold.
Anthropic · 17 February 2026 · Read the source - long-form virology tasks · The provider · Chemical, biological, radiological and nuclear
claude sonnet 4.6 achieved a “max of 5” score of 0.84 for virology task 1, placing it above the asl-3 rule-in threshold of 0.8.
Anthropic · 17 February 2026 · Read the source - malicious requests evaluation · The provider · Misuse & jailbreak
claude sonnet 4.6 refused 100% of malicious requests in our evaluation, which represented a slight improvement from our previous evaluation of claude sonnet 4.5.
Anthropic · 17 February 2026 · Read the source - most sabotage-related capability evaluation · The provider · Deception & sabotage
arguments about claude opus 4.6’s limited capabilities apply to claude sonnet 4.6, since claude sonnet 4.6 has capabilities generally below claude opus 4.6 and weaker performance on the most sabotage-related capability evaluation we ran (section 4.6.6).
Anthropic · 17 February 2026 · Read the source - multi-turn biological weapons evaluations · The provider · Chemical, biological, radiological and nuclear
in multi-turn biological weapons evaluations, for example, sonnet 4.6 provided high-level reverse genetics information when the request was reframed as “general molecular biology,” where sonnet 4.5 refused.
Anthropic · 17 February 2026 · Read the source - multi-turn conversation testing · The provider · Cyber
multi-turn evaluation results between claude sonnet 4.6 and claude sonnet 4.5 were not statistically distinguishable across the majority of categories, though we observed slight regressions in biological weapons and tracking and surveillance.
Anthropic · 17 February 2026 · Read the source - multimodal virology (vct) · The provider · Chemical, biological, radiological and nuclear
claude sonnet 4.6 achieved a mean score of 0.397 on the harder “multiple select” variant, well above the expert baseline threshold of 0.221.
Anthropic · 17 February 2026 · Read the source - new evaluation (similar to the impossible coding task setting) · The provider · Deception & sabotage
we found that sonnet 4.6 was by default substantially more likely to engage in over-eager hacking than previous models, consistent with anecdotal reports from pilot internal use .
Anthropic · 17 February 2026 · Read the source - over-eagerness evaluation on GUI computer use tasks · The provider · Autonomy & replication
sonnet 4.6 exhibits higher rates of over-eagerness than previous models on gui computer use tasks without prompting.
Anthropic · 17 February 2026 · Read the source - pilot GUI computer-use investigations · The provider · Misuse & jailbreak
in these simulated tests, sonnet 4.6 completed simple spreadsheet data-management tasks that were clearly related to criminal enterprises in areas like cyberoffense, organ theft, and human trafficking.
Anthropic · 17 February 2026 · Read the source - shade · The provider · Injection & agentic
Reported result: claude sonnet 4.6 extended thinking 0.0% 0.0% 0.0% 0.0% standard thinking 0.1% 7.5% 0.04% 5.0%
claude sonnet 4.6 showed very large improvements over claude sonnet 4.5, bringing attack success to 0% with safeguards and extended thinking.
Anthropic · 17 February 2026 · Read the source - shade indirect prompt injection attacks in computer use environments · The provider · Injection & agentic
claude sonnet 4.6 substantially outperformed claude sonnet 4.5 and demonstrated greater robustness than claude opus 4.6 in this setting.
Anthropic · 17 February 2026 · Read the source - short-horizon computational biology tasks evaluation · The provider · Chemical, biological, radiological and nuclear
in particular, it did not cross the threshold on our asl-4 rule-out evaluation short-horizon computational biology tasks evaluation.
Anthropic · 17 February 2026 · Read the source - ssh stress-testing evaluation · The provider · Harmful content
on the ssh stress-testing evaluation, which is described in more detail in the claude opus 4.6 system card , claude sonnet 4.6 showed quantitative improvement over claude sonnet 4.5 and falls in a similar performance range to our recently released claude opus 4.6 model.
Anthropic · 17 February 2026 · Read the source - time series forecasting · The provider · Autonomy & replication
claude sonnet 4.6 achieved a minimum mse of 5.70 in the hard variant, above the human baseline of 5.3, and its distribution of scores was slightly worse than claude opus 4.6’s.
Anthropic · 17 February 2026 · Read the source
No document we read states: a safeguard. No incident on record names this version.
Some documents we hold are stored in lower case only, so their quotes are shown in lower case. The source link opens the original.
Previous version: Claude Sonnet 4.5 · Compare the two
Documents listed for this version
- System Card: Claude Sonnet 4.6 · Anthropic · 17 February 2026
- User awareness in frontier models · Transluce · 6 August 2026
- Measuring coding agent misalignment in the wild · Transluce · 4 August 2026
- Untrusted advice for AI control: Short, strong advice significantly uplifts weak LLMs · Redwood Research · 27 July 2026
- How our new Control Red Team is stress-testing frontier monitors · UK AI Security Institute · 23 July 2026
- Evaluating LLM Calibration for Coding-Agent Monitoring · Apollo Research · 7 July 2026
- How frontier AI models perform on viral DNA assembly tasks (ABC-Bench) · SecureBio · 10 June 2026
- Claude overperforms at software engineering and underperforms at math · Epoch AI · 15 May 2026
- Evaluating whether AI models would sabotage AI safety research · UK AI Security Institute · 27 April 2026