# Claude Self-Assessment: Anthropic's Cheap Misuse Monitor

> Anthropic trained Claude to flag misuse in its own chats: 94% of high-priority cases for under 2% compute. What it found, and why it cannot block attacks.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-29
- Canonical (HTML): https://cellcog.ai/blog/anthropic-claude-self-assessment/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Anthropic announced self-assessment on October 29, 2026: right after Claude answers, it gives a short safety assessment of the whole conversation for offline review.
- On Claude Fable 5 it flags 78% of what a stronger classifier flags, and 94% of high-priority cases, at a 1% false-positive rate.
- It adds under 2% to inference compute because the conversation is already cached, and Anthropic does not bill the cost to customers.
- As a blocking classifier it is weak: attack success on 24 cyber tasks fell only from 79% to 54%, against 25% for a prompted classifier.
- It runs as one layer among Anthropic's safeguards, collects no additional user data and skips zero-data-retention traffic.

## At a glance

- **What is Claude self-assessment?** A technique where Claude, right after answering, gives a compact safety assessment of the conversation that feeds offline review.
- **How accurate is it?** On Claude Fable 5 it flags 94% of high-priority conversations a stronger classifier flags, at a 1% false-positive rate.
- **Does it block harmful requests?** No. It flags for later review; as a blocking classifier Anthropic calls it weak.

Anthropic has trained Claude to flag possible misuse in its own conversations, a technique it calls self-assessment. Right after Claude answers, a short hidden instruction asks it for a safety assessment of the whole conversation, and it replies with a compact verdict that goes to offline review. Anthropic [announced it on X](https://x.com/AnthropicAI/status/2115871889549865429) at 18:22 UTC on October 29, 2026, linking a [write-up on its new Safeguards blog](https://safeguards.anthropic.com/2026/self-assessment/) that is dated October 16 and signed by nine researchers. The write-up cites the reason monitoring has to keep pace: in late 2025 Anthropic [disrupted a cyber espionage campaign](https://www.anthropic.com/news/disrupting-AI-espionage) in which suspected state-sponsored attackers used Claude Code to attempt intrusions into roughly thirty organizations.

The pitch is cost. The conversation is already in the model's cache when the answer ends, so an assessment needs only a short instruction and about 10 output tokens. Anthropic estimates it adds less than 2% to its inference compute, and "We do not bill this cost to customers." It has run since Claude Fable 5 launched in June, in every Claude model released since, across a large fraction of Claude's traffic.

## How self-assessment works

![Animated diagram: a conversation bar already read gets a short amber Check tab and a small teal Reply with a flag, while a separate classifier reads the conversation again plus a stack of policy pages before giving a verdict](https://cellcog.ai/blog/media/anthropic-claude-self-assessment/cache.svg)
*Self-assessment reuses what Claude already read; a classifier reads it all again*

After each Claude response, the system appends an instruction the user never sees, something like "Please reflect on the safety of this conversation". Claude replies in a fixed JSON format. A clean conversation gets a plain no-flag answer. A flagged one adds the reason, the harm category and sub-policy (from an internal taxonomy that implements Anthropic's public [Usage Policy](https://www.anthropic.com/legal/aup)), whether Claude refused, and a priority from 1 to 10 for human reviewers. Those last two turns are dropped from the conversation afterwards.

Training runs in two stages, supervised fine-tuning then reinforcement learning, on fully synthetic conversations. The labels come from a teacher: a prompted classifier built on Claude Mythos Preview that reads every policy document and reasons through a checklist. Self-assessment learns to give the same answer with no policy in its prompt and no room to reason.

## The numbers

*Table: Self-assessment results, per Anthropic's Safeguards blog*

| Measure | Result |
|---|---|
| Recall at a 1% false-positive rate, Claude Fable 5 | 78% of conversations the teacher flags |
| Recall on high-priority conversations (priority 7 or higher) | 94% |
| Added inference compute | Under 2% (Anthropic's estimate) |
| Output per assessment | About 10 tokens on average |
| Recall at a 1% false-positive rate, smallest to largest test model | About 16% to about 96% |
| Fraud recall with fraud removed from training, production traffic | 83.3% to 82.1% |
| Cyber recall with cyber removed from training, production traffic | 94.2% to 90.7% |

Two results carry the argument. First, it scales: across four model sizes trained the same way, recall rose from about 16% to about 96%, and Anthropic concludes it is "most useful for frontier models." Second, it generalizes: removing a whole harm category from training barely lowered recall on that category. Anthropic reads this as Claude's sense of harm coming from what it already knows, with training teaching it how to report.

For comparison, Anthropic says its first Constitutional Classifiers, in early 2025, added 23.7% to inference cost, and the prompted classifier it uses as the teacher needs many times more compute per conversation. That teacher is still the stronger classifier; self-assessment wins on coverage per dollar.

## What it found in production

- **Scaled abuse.** In August, self-assessment raised over 100,000 child sexual abuse and exploitation flags from a single API customer. Anthropic's child safety team investigated and reported the material to NCMEC.
- **Unknown harms.** About a third of flags do not map cleanly to Anthropic's taxonomy. Clustering them turned up attempts to distill Claude's reasoning, prompt injection, and cases where Claude, acting as an agent, took actions the user had not authorized.
- **New enforcement.** More than half of the organizations it surfaced had no flags from any other detection source in the month before. In September its flags led to an operation that used Claude Code to run an automated romance scam targeting dozens of victims; the accounts were banned after human review.
- **Better classifiers.** Of conversations it flagged that a child-safety probe missed, a separate grader judged 41% to be violations, which showed gaps in the probe.

## It does not block attacks

Anthropic also tested whether self-assessment could block, not just flag, with an internal red-team harness: 24 offensive cyber tasks against Fable 5, production classifiers off. The verdict is in one line: "As a blocking classifier, self-assessment is weak."

*Table: Attack success on 24 cyber tasks against Claude Fable 5, per Anthropic*

| Setup | Tasks the attacker completed |
|---|---|
| No safeguards | 19 of 24 (79%) |
| Self-assessment blocking | 13 of 24 (54%) |
| Prompted classifier blocking | 6 of 24 (25%) |

Run offline, it did better: it flagged 21 of the 24 attack trajectories at least once, and an attacker gets no live signal about what was flagged. Anthropic is plain about the gap: self-assessment "does not catch every harmful conversation, and it is not robust enough to stop a dedicated attacker." It runs alongside real-time classifiers, not instead of them.

## Privacy and limits

"Self-assessment collects no additional data from users." It reads only the conversation Claude has just processed, under existing data rules, and it does not run on traffic covered by zero-data-retention agreements. The free-text reason can paraphrase a user's words, so Anthropic handles it like the conversation itself.

Anthropic lists two limits. Self-assessment inherits any blind spot in its teacher, and the evaluations use the same teacher, so they cannot see it. And watching Claude's own conduct is harder than watching users: a misaligned model could hide an action in its assessment too. "Self-assessment is not yet a reliable monitor of Claude's own conduct."

## Our read

The design is the interesting part: the cheapest monitor is the model that already read the conversation, and it improves every time the model does. Anthropic is also clear about what it is: a flag for later review, not a gate.

CellCog's AI employees run on Claude Opus 5.5, released after Fable 5, the point from which Anthropic says self-assessment runs in every Claude model. That layer sits on Anthropic's side. On ours, every command an employee sends that reaches your world is classified, and anything above the level you set waits for your approval.

## What we are watching

- **Human evaluations,** which Anthropic suggests to check whether human and model safety judgments agree.
- **Self-monitoring.** Whether self-assessment becomes a reliable check on Claude's own agent actions.
- **Coverage.** Anthropic says a large fraction of traffic and gives no number.

## Update log

As of October 29, 2026, 18:45 UTC: page opened from Anthropic's post on X (18:22 UTC) and its Safeguards blog write-up dated October 16, 2026.

## FAQ

**When did Anthropic start using self-assessment?**

Since Claude Fable 5 launched in June 2026, in every Claude model released since, across a large fraction of traffic. Anthropic announced it publicly on October 29, 2026.

**Does self-assessment cost customers anything?**

No. Anthropic estimates it adds under 2% to inference compute and says it does not bill this cost to customers.

**Does it collect more user data?**

Anthropic says it collects no additional data and reads only the conversation Claude just processed. It does not run on zero-data-retention traffic.

**What has it caught?**

Over 100,000 child abuse flags from one API customer in August, reported to NCMEC, a Claude Code romance scam operation in September, and new harm types such as prompt injection.

**Can it monitor Claude itself?**

Not reliably yet. Anthropic says a misaligned model could hide an action in its own assessment, so more research on honesty is needed.

## Related

- [Anthropic's Distillation Defenses: 90 to 99% Less Data Taken](https://cellcog.ai/blog/anthropic-distillation-defenses/index.md)
- [Claude Code Auto Mode: What It Does, How to Turn It Off](https://cellcog.ai/blog/claude-code-auto-mode/index.md)
- [OpenAI's Misalignment Reports: 20 Incidents, One Framework](https://cellcog.ai/blog/openai-misalignment-reporting-framework/index.md)
- [AI Agent vs AI Employee: Capability vs Accountable Role](https://cellcog.ai/blog/ai-agent-vs-ai-employee/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/anthropic-claude-self-assessment/. Try CellCog free, no credit card needed: https://cellcog.ai/signup