Anthropic said on 29 October 2026 that it has trained Claude to flag potential misuse in its own conversations, a technique it calls self-assessment. Right after Claude responds, it gives a short safety assessment of the conversation.
Anthropic’s Safeguards blog post on the technique, dated 16 October, says that on Claude Fable 5 it “flags 78% of the conversations that a stronger prompted classifier flags as potentially harmful, and 94% of the high-priority ones, at a 1% false-positive rate”. Anthropic says self-assessment adds less than 2% to its inference compute.
Short explainer · Claude self-assessment
A vertical news Short narrated from this piece’s headline and opening line.
A short explainer on the difference between a model and the harness around it. It teaches the general idea only and says nothing about Anthropic’s self-assessment.
The key insight: Anthropic says Claude now writes a short safety assessment of its own conversations after each reply, at less than 2% added inference compute, and uses the flags for offline review rather than real-time blocking.
After each of Claude’s responses, Anthropic says, a short instruction is appended and Claude replies with a compact safety assessment. The post says “The last two turns are not available to the user, and they are not carried into the rest of the conversation”.
The assessment follows a fixed format, Anthropic says: whether the conversation is flagged, a reason, a harm category and subpolicy, whether Claude refused, and a priority score from 1 to 10 for human review.
Anthropic says it runs self-assessment “in every Claude model we have released since Fable 5, across a large fraction of Claude’s global traffic”. It says the technique is passive in production: it flags conversations for review but does not block them.
Compute overhead of safety monitoring as reported by Anthropic: its first Constitutional Classifiers (early 2025) added 23.7% to inference cost; self-assessment adds less than 2%. Anthropic also cites OpenAI as reporting that safety reasoning used as much as 16% of total compute in some launches (a different scope). Source: Anthropic Safeguards blog, Scaling Misuse Detection with Self-Assessment.
What Was Posted on X
Weโve trained Claude to flag potential misuse in conversations, a technique we call self-assessment. Right after it responds, Claude gives a preliminary safety assessment of the conversation.
Since we began using self-assessment in June, it has surfaced misuse that our other safeguards werenโt designed to catch.
Because Claude has already read the conversation, self-assessment is very efficient. And unlike classifiers, which target a discrete set of harms, it draws on Claudeโs own judgment, so it gets more accurate as our models improve.
Anthropic on X, 29 Oct: “We’ve trained Claude to flag potential misuse in conversations, a technique we call self-assessment. Right after it responds, Claude gives a preliminary safety assessment of the conversation.”
What It Has Caught So Far
Anthropic says that in a growing set of harm areas, flags are aggregated by organization every night, and “organizations with several high-priority flags are escalated to our enforcement team for human review”.
The post says: “In August, self-assessment raised over 100k flags of child sexual abuse & exploitation from a single API customer”. Anthropic says its child safety team investigated and reported the material to the National Center for Missing & Exploited Children.
Anthropic also says it uses the flags to check its other classifiers and to cluster flags that fall outside its taxonomy, looking for new kinds of misuse.
The Cost Case, by Our Arithmetic
Anthropic says its first Constitutional Classifiers from early 2025 added 23.7% to inference cost, and that self-assessment adds less than 2%. By our arithmetic, that is roughly a twelfth of the earlier overhead. The post also cites OpenAI as reporting that safety reasoning has used as much as 16% of total compute in some launches.
Anthropic says recall rises with model size: at a 1% false-positive rate, from about 16% on the smallest of four test models to about 96% on the largest.
Anthropic’s red-team test on 24 offensive cyber tasks against Claude Fable 5 with production classifiers off: attacks succeeded on 19 tasks with no safeguards, 13 with self-assessment blocking and 6 with a prompted classifier; run offline, self-assessment flagged 21 of 24 trajectories (87.5%, our arithmetic). Source: Anthropic Safeguards blog.
Where It Falls Short
Anthropic says self-assessment “does not catch every harmful conversation, and it is not robust enough to stop a dedicated attacker”. In a red-team test of 24 offensive cyber tasks, it says attack success fell only from 19 to 13 tasks when self-assessment was used to block, against 6 with a prompted classifier.
Run offline, Anthropic says, it flagged 21 of the 24 attack trajectories at least once; by our arithmetic that is 87.5%.
On privacy, the post says “Self-assessment collects no additional data from users” and that it runs on traffic Anthropic can already retain under its existing policies. It also says: “We are still figuring out how to make self-assessment more effective while preserving user privacy”.
The Structural Read
As we read the post, the design trades blocking power for coverage: Anthropic reports it as weak at stopping attacks but cheap enough to run across a large fraction of traffic.
As we read it, the reference point matters: the 78% and 94% figures are measured against Anthropic’s own stronger prompted classifier, not against confirmed misuse.
By our arithmetic, the reported overhead is roughly a twelfth of the 23.7% that Anthropic says its first Constitutional Classifiers added to inference cost in early 2025.
Anthropic Safeguards blog
“Self-assessment collects no additional data from users”
Three Implications
FOR ENTERPRISE BUYERS Anthropic says flags are aggregated by organization every night in a growing set of harm areas, and organizations with several high-priority flags go to its enforcement team for human review.
FOR PRIVACY Anthropic says the assessments follow the same data-handling policies as its other automated systems and that it is still working on effectiveness while preserving user privacy.
FOR RIVAL LABS Anthropic cites OpenAI as reporting that safety reasoning used as much as 16% of total compute in some launches, a different measure from Anthropic’s inference figures.
The framework argues that Anthropic is “actively attempting to define the governance layer of the AI stack”.
As we read it, a monitor built into the model itself is one more piece of that layer. The framework was published by The Business Engineer and does not discuss self-assessment.
All figures come from Anthropic’s own post; we did not test the system. Its recall figures are measured against Anthropic’s own prompted classifier as the reference, not against confirmed misuse. The post does not give the share of traffic covered beyond “a large fraction”.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
Anthropic says Claude now grades its own conversations for misuse across a large fraction of its traffic, catching 94% of high-priority cases its stronger classifier flags at a 1% false-positive rate for less than 2% added compute, while saying the method cannot stop a dedicated attacker and that privacy questions are still open.
A note on sourcing. Facts and figures come from Anthropic’s Safeguards blog post on self-assessment, which the page dates 16 October 2026, read in full on 29 October 2026, and from Anthropic’s post on X of the same day. We did not test the system or contact Anthropic. Lines marked as our arithmetic are our own calculations from Anthropic’s figures.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
