Anthropic has published ten recommendations for building AI safety evaluations, and it used its own models’ scores to show how easily such a score can mislead. The post is called Building strong safety evaluations and is dated November 13, 2026.
The sharpest example is one model measured two ways. On Anthropic’s suicide and self-harm evaluations, Claude Fable 5.1 had an appropriate response rate of 60% on the API and 94% on claude.ai. The model was the same. The setup around it was different.
On this page · 9 sectionsOpen
Anthropic published Building strong safety evaluations on November 13, 2026: ten recommendations under four headings, for anyone who builds or relies on AI safety tests.
Its own example: on suicide and self-harm evaluations, Claude Fable 5.1 scored 60% on the API and 94% on claude.ai with a new system prompt.
Anthropic says a refusal count is the wrong score for crisis conversations. It reports the share of conversations handled appropriately from start to finish.
Single-turn tests are saturated: every recent model scores 94% to 98% on the API, so Anthropic uses them mainly as regression checks.
Claude Opus 5 and Opus 5.5 scored 98% and 94% on a romance scam evaluation. Anthropic says the gap was not statistically significant.
§ 01One model, two scores
- The two figures. Anthropic’s post gives them in one bracket: “60% on the API vs 94% on claude.ai with the new system prompt”.
- What Anthropic saw. Before it released Fable 5.1, its reviewers read transcripts from these evaluations. They saw that Claude sometimes implicitly validated self-harm as a coping strategy, even in responses that discouraged it.
- What it changed. Anthropic added an instruction to the claude.ai system prompt: “Claude does not tell someone that self-harm works, helps, or does something for them, even when they say so themselves”.
- Then it tested again. It re-ran the evaluation with that instruction and other targeted changes to the system prompt. The 94% is the result on claude.ai.
- Why the API differs. Anthropic describes the API as the raw model, as developers access it. On claude.ai the system prompt is applied.
- The gap, stated generally. “In testing Claude Fable 5.1, the difference in the appropriate response rate between these two configurations on our multi-turn safety evals was as high as 34 percentage points.”
- What the post leaves out. It does not give the claude.ai score from before the new instruction. So it shows the gap between the API and claude.ai. It does not show how far the instruction alone moved the score on claude.ai.
The post also does not say that the 34 points and the two figures are one measurement. The arithmetic fits: 94 minus 60 is 34.
| What was measured | Figure | Where |
|---|---|---|
| Claude Fable 5.1, suicide and self-harm evaluations, appropriate response rate | 60% | API |
| Same model and evaluations, with the new system prompt | 94% | claude.ai |
| Largest gap between the two setups, Fable 5.1, multi-turn evaluations | 34 points | API against claude.ai |
| Single-turn harmless response rate, every recent model | 94% to 98% | API |
| Romance scam evaluation, Claude Opus 5 | 98% | claude.ai |
| Romance scam evaluation, Claude Opus 5.5 | 94% | claude.ai |
| Confidence interval on multi-turn evaluations | Can exceed 10 points either way | API |
| Smallest sample Anthropic accepts | 100 items multi-turn, 1,000 single-turn | Its own evaluations |
§ 02The ten recommendations
Anthropic said on X: “On our Engineering Blog, we offer 10 recommendations for how to design, run and report them.” The page groups them under four headings. The one-line summaries in the table are ours.
| Heading | Recommendation | In one line |
|---|---|---|
| Safety first | Build a team with the right skills | Pair methods experts with domain experts from the start |
| Safety first | Run evals safely | Use a sandbox with no internet access and watch runs in real time |
| Design | Match the design to the question | An observational test shows a difference, a causal test shows why |
| Design | Measure what you mean to measure | Decide what a good response is before counting refusals |
| Design | Make sure the results generalize | Use multi-turn simulations built from real behavior |
| Run | Keep measures internally valid | Guard against leaked test items, shortcuts and a faulty grader |
| Run | Preregister | Write down metrics, comparisons and thresholds before seeing results |
| Report | Report statistics fully | Break results out by category and give uncertainty for every estimate |
| Report | Document everything | Say which setup was tested so the run can be repeated |
| Report | Disclose flaws responsibly | Tell the developer and give time for a fix before publishing |
Two details from the page:
- Its own incidents. Under the second recommendation, Anthropic says that in recent months, in response to its own incidents, it has hardened its evaluation environments. It has also “temporarily stopped running many evaluations that give models internet access”.
- The short version. Anthropic’s list if you only do three things: “write down the construct you want to measure before collecting data, validate your grader against human judgment before trusting any number it produces, and report uncertainty so readers can tell signal from noise”.
§ 03Why a refusal count is the wrong score
The obvious way to score safety is to count how often a model declines. Anthropic says that works for some requests, such as help with a scam, and fails for others.
- Crisis conversations. “When a user is in crisis, simply declining to engage is, itself, a failure”
- A perfect score that means little. “A model that refuses to respond to any prompt related to suicide or self-harm would get a perfect score on a refusal-rate eval, but it is not necessarily a safer model.”
- What Anthropic counts. Its multi-turn evaluations report an appropriate response rate. That is the share of conversations in which the model behaved appropriately throughout, judged against a rubric that domain experts wrote for that risk area.
- One bad turn. A single bad turn fails the whole conversation.
- Both directions. In single-turn evaluations Anthropic pairs harmful requests with benign ones in the same domain. It measures harmless responses to the first kind and refusals of the second.
§ 04Easy tests stop telling you anything
On the API, Anthropic says, harmless response rates on its single-turn evaluations are between 94% and 98% for every recent model. Rates on multi-turn tasks range much more widely.
Its own reading: “In other words, the single-turn tasks are saturated, and are therefore useful mainly as regression checks on known failure modes.”
The fix it recommends is to make tasks harder while still measuring the same thing. It names longer horizons, subtler presentations and more natural writing. It advises against trick questions.
§ 05The grader can be what you measured
Most evaluations now use a second AI model to grade the answers, because no human team can read hundreds of thousands of transcripts. Anthropic says these graders can fail without anyone noticing.
- The test of a grader. “If the conclusions change when the grader does, you’ve likely measured the grader, not the model, and need to update it.”
- Yes or no. Use narrow yes-or-no criteria in place of one overall score.
- Framing. Tell the grader that disclaimers, caveats and educational framing do not make harmful content harmless.
- A different model. Consider grading with a different model from the one being tested, since model graders have been shown to favor their own outputs.
- People first. Have humans label a sample without seeing the grader’s verdicts, then report how often the two agree.
- Fail loudly. When the grader breaks on an item, flag the item and exclude it.
§ 06A four-point gap that proves nothing
Anthropic measured two of its models on a multi-turn romance scam evaluation on claude.ai. Claude Opus 5 scored 98% and Claude Opus 5.5 scored 94%.
Its conclusion: “However, the difference between the two models wasn’t statistically significant, so we couldn’t conclude that one performed better than the other.”
- Sample size. “We treat 100 items as the floor for a complex, multi-turn eval and 1,000 as the floor for a simpler, single-turn one.”
- Uncertainty. Anthropic says its system cards attach confidence intervals to scores. For multi-turn evaluations on the API these can exceed 10 percentage points either way.
- For readers. A small difference between two safety scores, given without an interval, tells you little about which model is safer.
§ 07What we did not check
- We read the whole post. We did not read the system cards it draws its examples from.
- We did not open the pages it links to. The two tools in our sources are linked as Anthropic names them.
- We ran no evaluation ourselves.
- The one-line summaries in the second table are ours, not Anthropic’s wording.
- Anthropic’s post on X had about 101,000 views at 22:18 UTC on November 13.
§ 08Where CellCog sits
We build on Anthropic’s models, so we have a stake in how they are judged. CellCog’s Agent Max and Creative Max tiers run on Claude Fable 5.2, and our other tiers run on Claude Opus 5.5, as recorded on our Fable 5.2 page. No CellCog tier runs Fable 5.1.
We build on those models as a developer, with our own instructions, not through claude.ai. By the post’s own reasoning, a score measured on claude.ai does not describe a product built on the API, and neither does a score for the raw model. Neither of the two figures above is about CellCog.
§ 09Sources
- Anthropic, Building strong safety evaluations, November 13, 2026. The page says it was last modified at 18:39 UTC, and we read it at 22:01 UTC.
- Anthropic on X, November 13, 2026, 19:00 UTC.
- Named in Anthropic’s post and not read by us: the UK AI Security Institute’s Inspect framework and Anthropic’s Petri toolkit.
Q1What are Anthropic's ten recommendations for safety evaluations?
They sit under four headings: Safety first, Design, Run and Report. They cover who builds the test, running it in a sandbox, matching the design to the question, measuring the right thing, realistic scenarios, sound grading, preregistration, full statistics, documentation and responsible disclosure.
Q2Why did Claude Fable 5.1 score 60% on the API and 94% on claude.ai?
Anthropic says it added an instruction about self-harm to the claude.ai system prompt, with other targeted changes, and re-ran the evaluation. The API has no such prompt. The post does not give the claude.ai score from before the change.
Q3What is an appropriate response rate?
It is the share of test conversations in which the model behaved appropriately from start to finish, judged against a rubric that domain experts wrote for that risk area. One bad turn fails the whole conversation.
Q4Does a higher refusal rate mean a safer model?
Not always. Anthropic says that for conversations about suicide and self-harm, declining to engage is itself a failure, so a model that refuses everything would score perfectly on refusals without being safer.
Q5Do Anthropic's safety scores apply to products built on Claude's API?
Not directly. Anthropic reports results for the API and for claude.ai separately because the system prompt changes them. A product built on the API runs its own instructions, so neither figure describes it.