Claude Now Grades Its Own Chats for Misuse After Every Reply

Most AI safety lines sit at the door: requests pass a classifier on the way in, and suspicious ones get refused. The approach Anthropic just made public has the model take a second look after it has answered.

Anthropic described a technique it calls self-assessment. After each Claude response, the system appends a short instruction, roughly "please reflect on the safety of this conversation," and Claude replies with a compact safety assessment. It has been running in production since June, across every Claude model released since Claude Fable 5 and a large share of global traffic.

Letting the speaker judge the conversation

The assessment follows a fixed JSON schema. If nothing is wrong, it is simply "not flagged." When something is flagged, it records the harm category, the relevant sub-policy, whether Claude refused, a 1-to-10 priority for human review and a one-sentence reason. Users never see these extra turns, and they aren't carried into the rest of the conversation.

The clever part is cost. The conversation is already in the KV cache, so an assessment needs only a short instruction and a few output tokens; one report puts the added inference cost under 2%. Compared with running a separate large classifier over the whole transcript, it is nearly free.

The scaling logic matters even more. The assessor is the same model that just had the conversation, so as models get smarter, the assessments get better. Safety capability grows with model capability instead of trailing a generation behind.

Good numbers, not a cure-all

On Claude Fable 5, measured against a stronger classifier that has the full safeguards policies in context, self-assessment flags 78% of potentially harmful conversations and 94% of high-priority ones at a 1% false-positive rate. It covers a wide range of harm areas, including rare ones that don't have a dedicated classifier yet. Anthropic says that since June it has surfaced large-scale misuse other methods missed and helped improve other classifiers.

Anthropic is blunt about the limits. It doesn't catch every harmful conversation, and it isn't robust enough to stop a determined attacker. In a cyber test with normal production classifiers turned off, attackers succeeded on 19 of 24 tasks with no safeguards, 13 with self-assessment and six with a separate prompted classifier. So in production it serves as an offline monitor: it doesn't interrupt users or block in real time, it casts a wide net and passes suspicious conversations to higher-precision investigation tools and human reviewers.

One more layer of defense in depth

After-the-fact review complements real-time blocking. Tight real-time filters frustrate legitimate users; a background check can cover broadly without degrading the experience. For enterprise customers that means fewer pointless refusals; for safety teams, a wider net.

Having a model police itself naturally raises a question: would a successfully jailbroken model cover for itself in its own review? Anthropic's choice to benchmark against an independent classifier and keep self-assessment as one layer among many is, in part, an answer to that worry. OpenAI is talking up monitoring of frontier model behavior at the same moment. Safety is moving from alignment at training time to continuous observation at runtime, and that shift may matter more than any single technique.