Anthropic trains Claude to flag possible misuse after each reply

Anthropic has trained Claude to give a preliminary safety assessment of each conversation right after it responds, a technique the company calls self-assessment, according to India Today’s report of a post Anthropic shared on X. The most important detail is how the check is used: it flags possibly harmful chats for later human review rather than blocking them, and Anthropic says it has quietly been running across models such as Claude Fable 5 since June 2026.

Because the check relies on Claude’s own judgment instead of a fixed list of rules, Anthropic says it gets more accurate as the underlying models improve and can catch complex misuse that older safeguards were never designed to spot. All of the performance figures below come from Anthropic, as reported by India Today; none of the sources includes an independent evaluation.

How Claude checks its own conversations

A normal exchange with a chatbot is a simple back-and-forth. Self-assessment adds one step that happens out of sight. Right after Claude generates an answer, the system appends a hidden instruction asking the model to review the exchange. Claude then writes a short internal verdict that records three things:

• whether the request was harmful,
• the type of harm involved, and
• a priority score for human review.

If the conversation is judged safe, the system registers it as unflagged and moves on. The user is not interrupted and does not see a pop-up warning. Because Claude has already read the whole conversation in order to answer, the check can reuse the model’s stored memory of the chat rather than processing it again from scratch, which is what makes the extra step cheap.

This is a different design from the safety tools Anthropic has described publicly in its help documentation. Those include separate detection models that flag potentially harmful content against Anthropic’s Usage Policy, safety filters on prompts that may block the model’s response when those detectors fire, and “enhanced” filters with higher sensitivity that Anthropic may temporarily apply to users who repeatedly break its policies. Self-assessment moves part of the judgment into the model that is already in the conversation.

What self-assessment costs compared with older safeguards

Running a second system to watch every conversation is usually expensive. Anthropic’s figures, as India Today reports them, put each self-assessment check at about 10 extra tokens (tokens are the small chunks of text models read and write) and less than 2% of total computing cost.

For comparison, the report says Anthropic’s older safety systems added nearly 24% to costs, and that OpenAI has reported safety features consuming up to 16% of computing power. The sources do not explain how those figures were measured, so they are better read as rough indications than as a like-for-like comparison.

Measure (Anthropic’s figures)	Self-assessment	Comparison given
Extra tokens per check	About 10	Not stated
Added compute cost	Under 2%	Nearly 24% (Anthropic’s older systems); up to 16% (OpenAI, as reported)
Harmful conversations caught (Claude Fable 5)	78%	Not stated
High-priority cases caught (Claude Fable 5)	94%	Not stated
False-positive rate	1%	Not stated
Attack success, cybersecurity tests	54% (self-assessment alone)	79% with no safeguards; 25% with a dedicated real-time blocker

Source for all figures: India Today’s report of Anthropic’s post.

How accurate Anthropic says it is

On Claude Fable 5, Anthropic says self-assessment catches 78% of harmful conversations overall and 94% of high-priority cases. It reports a false-positive rate of 1%, meaning about one in a hundred harmless conversations would be flagged by mistake.

Anthropic also points to a test of how well the method handles harm it was never shown. When researchers held back examples of fraud and cyberattacks from the training data, the model still detected 90% of those threats, according to the report. The company’s argument is that the check draws on Claude’s general knowledge, so it can recognise new, uncatalogued kinds of misuse without being trained on each one.

The company also cites real-world use. In August, self-assessment flagged more than 100,000 cases of child exploitation material tied to a single customer, which Anthropic reported to the authorities, India Today says. Anthropic’s help centre lists CSAM detection and reporting among its user-safety topics, though the sources do not describe how self-assessment feeds into that process in detail.

Three caveats apply. These are the company’s own measurements. The sources do not describe the test sets behind the 78% and 94% figures. And the 1% false-positive rate needs context: across a large volume of conversations, even a small share can mean many harmless chats sent for human review.

Where it falls short: a flag, not a block

Anthropic is explicit that self-assessment is a monitoring tool. It is built to flag issues for later offline review, not to stop them as they happen, and the company says it is not strong enough to stop a dedicated attacker on its own.

The internal cybersecurity tests make the gap concrete. With self-assessment as the only safeguard, attackers got past the model 54% of the time. That is better than the 79% success rate with no safeguards, but a dedicated real-time blocking system cut attack success to 25%. For that reason Anthropic describes self-assessment as an extra layer of background monitoring, while keeping stronger, independent safety blocks in place for real-time defence.

This fits how Anthropic already describes its safeguards in general. Its help centre says its safety features “are not failsafe” and that it “may make mistakes through false positives or false negatives”. Self-assessment adds a cheaper detection layer; it does not change that basic trade-off.

What it means for developers building on Claude

For teams that build products on Claude, the practical points are about visibility and review, not about latency or output.

• Answers are not changed in the moment. The check runs after Claude responds and, as described, does not interrupt the user or add warnings. Real-time blocking still comes from Anthropic’s separate safeguards, such as the prompt filters described in its help centre.
• Flags go to human review. Each flagged conversation carries a harm type and a priority score for reviewers. India Today’s headline frames this as Claude flagging chats to Anthropic.
• Customer-level patterns are visible. The August case involved a large volume of material tied to one customer. Businesses whose end users send traffic through their accounts should assume that misuse by those users can surface at the account level. Anthropic’s help documentation already describes applying stricter filters to users who repeatedly violate its policies.
• False positives are possible. At Anthropic’s stated 1% rate, some harmless conversations will be flagged. The help centre lists a “Safeguards warnings and appeals” article among its related resources. The sources do not say how self-assessment flags connect to warnings or appeals.

The sources leave several things open. They do not say exactly which products or access routes the check covers, whether it applies the same way to direct API traffic as to Anthropic’s own apps, or how long flagged conversations are kept. They also do not say whether developers can see which of their conversations were flagged. Teams with strict data-handling requirements will want Anthropic to answer those questions directly.

How self-assessment fits Anthropic’s published safety reporting

Anthropic publishes model-by-model summaries on its Transparency Hub that cover capabilities, safety evaluations and deployment safeguards; the most recent model report there is dated October 2, 2026. The hub lists Claude Fable 5, the model the self-assessment figures refer to, alongside newer releases such as Claude Fable 5.1, Claude Opus 5.5 and Claude Sonnet 5.5. For Sonnet 5.5, released in September 2026, Anthropic says it deployed the model with the same chemical and biological misuse protections it used for Claude Opus 5.

The self-assessment results reported so far refer to Claude Fable 5. The sources do not include comparable numbers for the newer models listed on the hub. Anthropic says the method should improve as its models improve, so results for newer models would show whether that claim holds.

Unicorn API has also covered other Anthropic safety and security news, including the company’s report that an unreleased Claude built working Chrome and Safari exploits. The cybersecurity test results for self-assessment point to the same concern: a determined attacker can still get past a check that only flags conversations after the fact.

What to watch next

• Primary documentation. So far the details come through Anthropic’s post on X as reported by India Today. A technical write-up or system-card section with the test sets and methods behind the 78%, 94% and 1% figures would allow these numbers to be checked.
• Scope and data handling. Which products, models and access routes self-assessment covers, how long flagged conversations are kept, and whether developers are told when their traffic is flagged.
• Newer models. Whether Anthropic publishes self-assessment results for models newer than Claude Fable 5 that show the accuracy gains it expects.
• Rival approaches. The report cites OpenAI’s safety features as using up to 16% of computing power. Watch whether other model makers adopt similar after-the-fact checks run by the model itself to cut monitoring costs.
• Independent testing. Third-party red-teaming would show how easily attackers can get past self-assessment and the real-time safeguards Anthropic keeps alongside it.