As Claude grows more capable, adversaries will have greater incentive to defeat our safeguards, and the stakes of misuse will rise. In our Responsible Scaling Policy, we set a goal that we would be able to find vulnerabilities in our safeguards better than expert human red-teamers.1 To achieve this, we built Anvil, an automated red-teaming system, which outperforms human red-teamers against our bioweapons, cybersecurity, and distillation safeguards. In biology, in particular, Anvil finds stronger jailbreaks than all human red-teamers in our bug bounty program combined—and does so faster and more efficiently.
Anvil is a powerful tool for improving our safeguards, and lets us evaluate against attackers that are stronger than those we observe externally. Today, we use Anvil to vet the robustness of new safeguards before we deploy them, and we’ll continue to use it to improve our defenses going forward. It would be very difficult for an external attacker to build a system as strong as Anvil today: It relies on frontier internal versions of Claude with safeguards disabled to find the best jailbreaks, and we don’t observe jailbreaks of this level of sophistication in real traffic. But Anvil’s performance improves with the strength of the model it runs on, suggesting that attackers could soon build similar systems on models with weaker safeguards. As a result, we expect a dynamic similar to cybersecurity, where gains in model capability strengthen both attackers and defenders, and privileged frontier model access will allow defenders to find vulnerabilities in their safeguards before attackers do. Our results underscore the urgency with which model developers should consider adopting similar methods, and outline a path toward safeguards that are robust to misuse by future, more capable adversaries.
Introduction
We develop and deploy safeguards to prevent malicious actors from misusing Claude. In our recent threat intelligence report, we described attempts to use Claude to engineer more virulent viruses, orchestrate sophisticated cybercrimes, and conduct large-scale, illicit distillation campaigns. We expect that rapid improvements to Claude’s capabilities will provide even greater incentive for threat actors to circumvent our safeguards. Once a safeguard is live, attackers can spend weeks or months trying to get around it. But in order for us to iterate before deployment, we need to be able to find out whether it is robust in hours or days.
We’ve historically tasked human red-teamers with identifying vulnerabilities in our safeguards via external contractors and bug bounty programs. However, as our safeguards have increased in robustness, we’ve found that human testers are increasingly unable to discover serious vulnerabilities quickly. For example:
- In a recent bug bounty focused on our bio classifiers, which pays participants for jailbreaks, red-teamers found a high-severity jailbreak on only 1 of 8 questions, and a weaker jailbreak on 3 others, despite 430 hours of dedicated red-teaming over more than seven weeks.
- In cybersecurity, two teams of external experts spent more than 225 hours and sent more than 42,000 requests red-teaming the safeguards on Fable 5.1 and Opus 5.5 without finding a universal jailbreak. Against Fable 5.1, none of the 11 potential jailbreaks they reported managed to trick the safeguarded model into completing an exploit end-to-end; in many cases they also relied on weaker models with weaker safeguards to do part of the work. Against Opus 5.5, the 13 potential jailbreaks the experts reported included only one full exploit, which was assembled over more than 100 different contexts, on an already publicly documented vulnerability.
- When we hired external experts to red-team our anti-distillation classifiers, humans took over 27 hours to find a single substantial reasoning leak.
The robustness of our safeguards to hours of human review still leaves open the possibility that vulnerabilities that would take human red-teamers far longer to find could sit undiscovered in live safeguards. In order to mitigate these risks and stay ahead of adversaries, we developed an internal automated red-teaming system, Anvil, which uses Claude to proactively discover vulnerabilities. Across domains, Anvil is able to discover more serious jailbreaks more efficiently than expert human red-teamers. It enables fast iteration on our safeguards before deployment, leading to improvements in real-world robustness. Given that Anvil improves with Claude’s underlying capabilities, we are optimistic that it will help our safeguards continue to deter sophisticated adversaries and keep pace with exponential improvements in model capabilities.
Anvil meets the goal set out in our Frontier Safety Roadmap (as part of our Responsible Scaling Policy) to develop internal automated red-teaming systems which match or exceed the ability of human red-teamers. Our RSP considers these red-teaming capabilities to partially mitigate the risks of accelerated AI progress induced by models that increasingly assist in their own R&D, since they would allow us to scale our safeguards to match the potential risks of the misuse of these much more powerful systems. While the objective as written focuses on jailbreaks of our bio safeguards, we also set out to improve our red-teaming abilities more broadly.
Anvil exceeds the abilities of humans to find jailbreaks. On the 8 questions from our standing bio bug bounty, against every classifier we tested, Anvil matches or beats the best human jailbreak, and finds these jailbreaks in 24–48 hours rather than weeks to months. It also finds universal jailbreaks that are more severe and work more reliably than the best human candidates, and it discovers effective attack strategies that humans never do. When humans and Anvil attempt the same jailbreak strategies, Anvil usually executes them better. The advantage carries over to other domains. On realistic cyber tasks, Anvil gets our safeguarded model to write full working exploits of known historical vulnerabilities in the JavaScript engines of Chrome and Firefox, achieving arbitrary code execution. It also broke every task on every model we gave contracted expert red-teamers, in 0.4–4.4 hours each, where the experts took up to 177 wall-clock hours and broke fewer instances. Against our anti-distillation classifiers, Anvil reached its first substantial reasoning leak after 435 requests (1.2 hours), compared to the 102,200 requests (27.9 hours) that it took expert red-teamers to find a similar jailbreak.
Anvil also accelerates improvements to our safeguards. Jailbreaks found by Anvil let us fix vulnerabilities before deployment, build static evaluations to hillclimb on, and conduct adaptive evaluation of our safeguards. While the specific bio and cyber classifiers we study here were not trained with Anvil in the loop, in our anti-distillation work we used static evaluations consisting of Anvil jailbreak transcripts to hillclimb on robustness over several generations of classifiers meant to block extraction of Claude’s hidden reasoning. As the classifiers improved, the share of Anvil attacks they missed in our evals fell from 31.5% to 0.4%. Importantly, progress on Anvil’s evaluations tracked progress in robustness to real attackers: on Fable 5.1, for example, the success rate of reasoning extraction attempts we observed in real traffic fell from 33.8% to 0%. We may also use Anvil as an adaptive evaluation by measuring how much compute is required to break a particular safeguard, which lets us compare candidates and predict robustness before deployment. For example, our current anti-distillation safeguards take roughly three times as many calls from Anvil to break as the early versions they replaced.
We believe that the jailbreaks we found represent rare failures of our classifiers which would be difficult for external attackers to achieve today. Specifically, in order to discover jailbreaks on the hardest tasks, Anvil requires a) very strong models (we achieve some of our best results with frontier internal models); b) visibility into exact classifier scores only possible within Anthropic; and c) disabling safeguards on the Claude instance used as the attacker—without which nearly all usage is blocked (Figure 11). Furthermore, Anvil’s jailbreaks are tuned to specific tasks and don’t easily carry over to other tasks in the same domain, which limits how much harm any one of them could do. Nonetheless, we expect these conditions to shift as open models with weaker safeguards become more competent, creating a dynamic similar to cybersecurity, in which privileged access to frontier models empowers model developers to identify vulnerabilities in their safeguards before adversaries do. We’re using this window to make our own safeguards robust to attackers like Anvil, pushing the frontier of robustness in the process.
In the rest of this blog, we first explain Anvil’s results in more detail, in relation to biology, cyber, and distillation. Then, we describe how it was created, and what its implications are for defenders today.
World-class internal red-teaming
How it works
Anvil provides an interface for Claude to autonomously iterate on jailbreaks through interaction with target models and classifier systems on a set of tasks that we would hope to block. It builds on our previously-described investigator agent. In practice, on each task, we run multiple independent investigator sessions in parallel, which may optionally be seeded with a high-level jailbreak strategy like “work in a foreign language” or “decompose the request across turns”. Through repeated interaction, Anvil leverages model intelligence to develop sophisticated multi-turn jailbreaks. In what follows, we share results from applying Anvil to diverse red-teaming tasks in biology, cybersecurity, and distillation.
Outperforming human red-teamers in our bio bug bounty
Historically, we have tested the adversarial robustness of our bioweapons safeguards through bug bounty programs, which task human red-teamers with finding jailbreaks. These programs award significant bounties of up to $35,000 for successful jailbreaks. However, we’ve noted important limitations in our recent bug bounties. First, human red-teamers have failed to find substantial jailbreaks on over half of the questions in our recent bounties, even though we have discovered instances of such jailbreaks internally. As a result, we’re increasingly skeptical of how well these programs model a motivated adversary. Second, the findings that humans do discover take them weeks to months to come up with, which prevents us from using bug bounties as a signal to quickly iterate on classifiers before deployment. Third, human successes in our bug bounty appear to be decelerating over time: Humans discovered $1.1M worth of jailbreaks over 95 distinct reports in the 8 months of 2025 that bounties were active, compared to $190k over 20 reports in 2026 thus far. Finally, we’re not able to share privileged internal details about our safeguards, such as continuous scores associated with each prompt, with the public, which can be useful for accelerating red-teaming. Therefore, we’re not sure if human bounties will be able to efficiently discover worst-case failures of our safeguards going forward.
Correspondingly, we set an objective in our Frontier Safety Roadmap to develop an “internal jailbreak-finding method for classifier guards (focused on chemical and biological weapons) that matches or exceeds the current collective abilities of all of our bug bounty participants to find jailbreaks,” which we planned to assess through a determination of whether our internal findings are “more substantial in aggregate” than all of our bug bounty findings. We now assess that we have met this goal by comparing the results of running Anvil to those of our bug bounties. We apply Anvil to the same set of 8 questions and production classifier systems as humans worked with in our standing harmful bio bounty, and find that the system is able to efficiently discover effective and diverse jailbreaks. We compare our results to the results of a series of bug bounties which ran against three generations of classifiers spanning from April 20th to September 11th, 2026.
We conclude that our internal findings are more substantial than the findings of our bounties, which we arrive at through several views. First, we show that across classifier systems and questions in our bug bounty, Anvil finds significantly stronger jailbreaks, and does so more quickly and efficiently than the bounty program. Second, we show that Anvil discovered several high-severity universal jailbreaks, which outperform the best candidate human universals recorded in our latest bug bounty. Finally, we cluster attack transcripts found by humans and Anvil together to understand their qualitative differences. We observe that Anvil covers many of the same attack classes found by humans, and finds strong jailbreaks within them more effectively, while also identifying several high-performing unique attack classes that were not discovered by humans.
Anvil is able to discover more severe jailbreaks more quickly and efficiently than running a human bounty (Figure 1). We measure jailbreak severity using a model-graded severity score that captures the degree of uplift an answer provides to a biological novice, which we validated with an Anthropic biologist for accuracy. In Figure 1a, we compare running Anvil and our human bounty against the same three recent production classifiers, and plot the severity score of the best jailbreak found on each question as radar plots. We observe that Anvil finds a substantially better jailbreak than the bounty in 23 out of 24 of the question-classifier pairs, and ties the human solution on the remaining single instance at the maximum score. These results suggest that Anvil is better than human red-teamers at surfacing the worst-case failures of our safeguards, and is in turn a better proxy for a competent adversary. In Figure 1b, we plot the severity score of the best jailbreak found averaged over questions (light lines) and additionally over classifiers (bold lines) as a function of the wall-clock time it took to discover the jailbreak, for both Anvil and the human bounties. We observe that in 24-48 hours, Anvil discovers jailbreaks which cross the strong answer threshold, indicating significant uplift to a novice, while humans take weeks to discover jailbreaks that fail to reach the weak answer threshold. Finally, in Figure 1c, we show the best jailbreak found as a function of the number of messages sent to the target model, comparing the total messages sent by Anvil against the total messages sent across all humans in each bug bounty. Anvil is more query-efficient: at every message budget its average severity exceeds the humans’.
Anvil is also able to find strong universal jailbreaks, which we define in our bug bounty to be a single prompt template which with minor per-question adaptations elicits successful answers to all 8 questions in the bounty. We are especially concerned about universal jailbreaks as they may represent larger structural vulnerabilities in our classifiers and can be used to misuse Claude at scale. As a result, we pay an additional bonus in our bug bounty for finding a universal jailbreak of this kind. Over the course of the most recent bug bounty we study, human red-teamers identified a small number of candidate universal jailbreaks which shared a prompt template. However, when evaluating these candidates closely, we observe that even the best provide limited uplift to a novice on some of the questions. In Figure 2, we compare the top two candidates submitted by humans (blue) against the three best universal jailbreaks produced by Anvil (orange). We report the mean and max severity scores over 100 answers resampled from the target model, given the fixed per-question prompts. In broad strokes, we may consider the mean performance of a jailbreak prompt to reflect the expected harm of a single human attempt, and the max as reflecting the worst-case harm from a persistent attacker. We observe that both at the question level and in aggregate, the Anvil-produced universals outperform the human ones, both in terms of average-case harm and worst-case risk. These results suggest that Anvil is more capable than our human red-teamers at discovering universal jailbreaks.
Anvil finds effective jailbreak strategies that humans never discovered, and it executes many of the strategies humans did find more effectively. To understand this, we took all the human transcripts from the most recent bounty that we study, and the transcripts from several independent runs of Anvil. For each question, we sampled 1,000 human and 1,000 Anvil attack conversations, stratified across judged severity and classifier score, in order to reflect both the diversity and varied effectiveness of jailbreaks from each source. Next, we had Claude summarize each conversation's attack strategy, which we then use to cluster the conversations into 54 strategy clusters. We observe that some clusters contain transcripts from both sources, while others contain transcripts from only humans or only Anvil. In Figure 3, we visualize each cluster along the x-axis. On the y-axis, we show a combined score that reflects both the severity of the extracted content and how far it stays under or over the production classifier's threshold; it is high only for responses that are both harmful and unflagged. We group transcripts by source and cluster, and then compute the per-question best of this combined score, reflecting “on this question and for this strategy, what is the best jailbreak found by humans and by Anvil?”. In the figure, we report this best score averaged over questions, showing the overall quality of humans and Anvil implementing that particular strategy as bars, and the highest scoring question’s score as a thick line. Below each bar, we display a per-question profile, shaded by each question’s best score, to indicate which questions that strategy was most effective on. We observe that many strategies appear in both sources (30 shared clusters, against 18 human-only and 6 Anvil-only), and where they overlap, Anvil tends to execute them better: its average per-question best score is higher than the humans' in 21 of the 30 shared clusters. Strategies unique to Anvil are also more effective than those unique to humans, with a median cluster score of 0.65 and 0.38. We take these findings as evidence that Anvil covers most of the attack strategies that matter: the strategies only humans found rarely produce useful harmful content, while the strategies only Anvil found are substantially stronger. However, given that Anvil can often execute a given strategy better than a human, we believe that Anvil could also be used as a force-multiplier for testing human jailbreak ideas against frontier safeguards.
Jailbreaking strong classifiers on realistic cyber tasks
With minimal adaptation, Anvil finds strong jailbreaks on cybersecurity tasks under our latest production safeguards. In contrast to the setting of our bug bounty for bio classifiers, which only requires getting a model to provide biological information, cyber tasks require eliciting sophisticated agentic behavior in realistic sandboxed environments without triggering a classifier. In this section, we demonstrate that Anvil can manipulate our safeguarded model to execute exploits and achieve arbitrary code execution in an eval sandbox. We also find that Anvil discovers more successful jailbreaks faster than the human red-teamers.
We focus our evaluation on 4 benchmarks. ExploitBench V8 consists of 41 tasks where an attacker must get a target model to exploit historical bugs to reach arbitrary code execution in Chrome’s V8 JavaScript engine. ExploitGym tasks require an attacker to get a target model to extend an input that chains a historical bug in open-source software into an exploit that runs code and reads a protected flag. We use a subset of 10 tasks from this benchmark of varying difficulty. Finally, we report results on two internal evals: one based on Firefox JS shell exploits from our partnership with Mozilla and an internal Cybertasks eval where the target model must carry out a prohibited action under Anthropic’s cyber policy.
Anvil orchestrates an Opus 5 target model to bypass its safeguards and complete almost every cybersecurity task we tested on. Figure 4 below shows the fraction of harmful cyber tasks completed as a function of attacker cost measured by the number of messages sent to the target model, which also correlates with the API cost and wallclock time. We plot this curve for Anvil against the safeguarded target model in orange, and, as a point of comparison, the same model without safeguards in gray. For the most complex benchmarks like ExploitBench, Anvil breaks the safeguarded target model on a median task in just 2,800 messages sent. The other benchmarks use even lower cost. We observe that the attacker cost scales with the difficulty as well as the harmfulness of the task. We note that while this result considers the ability of Anvil to bypass safeguards on the target model, we find that enforcing our safeguards on the attacker model would make it difficult for external adversaries to build a system like Anvil on top of Claude, which we discuss further in Implications for defenders.
Figure 4 also shows that while Anvil eventually beats our safeguards, they increase the cost for the malicious actors by up to 28× in the number of attacker messages required. In the figure above, the gray curve shows the same break rate on the same target model without any safeguards deployed. Here, most of the tasks could be completed in 100 to 1k messages. However, when safeguards are in place on the target model, the attacker has to simultaneously circumvent the safeguards while solving the task which increases the number of messages to 1k-10k per task. Most of the additional calls are indeed blocked by our classifiers which would have given us strong signals to stop the violating account by other means.
Anvil also finds more breaks in a shorter period of time compared to the efforts of expert human red-teamers we contracted (Figure 5). The expert human sessions were collaborations between humans and AI agents (not a human typing every prompt). Among the 6 Cybertasks tasks and 4 models (Opus 5, Fable 5, Fable 5.1, and Opus 5.5) we shared with the experts to red-team, the experts attempted to find jailbreaks on a subset of 22 of the 24 possible task-model pairs. Out of those 22, they reported successful breaks on 11 task-model pairs, where they claimed to have bypassed our safeguards and made substantial progress on the task. After analyzing their findings, we found that in 9 of 11 of these instances, a separate helper model with weaker or no cyber safeguards wrote the malicious attack code or executed it. This does not meet the stricter bar we set for Anvil where the safeguarded model must write and execute every step itself. In contrast, Anvil found legitimate breaks for all these task-model pairs (24 of 24). Based on the reported numbers and the model transcripts, we calculate the combined length of the active sessions (0.4–20 hours) and the overall calendar hours (0.6–177 hours) until the first break is found for each task and model pair. On the same set of task and model pairs, Anvil found the breaks in 0.5–3.5 hours. Beyond these Cybertasks, the expert humans could not find a break on the other 3 ExploitBench or 2 Firefox tasks (considered more difficult than the 6 Cybertasks tasks). Anvil finds breaks on all of them.
Anvil outperforms our internal state-of-the-art for jailbreaking. We compare against our previous best red-teaming harness, in which the attacker agent can rewind conversations but does not have access to additional tools for probing the classifier scores or more sophisticated attack strategies (see Harnessing frontier capabilities for red-teaming). Given a similar attack budget per task, Anvil breaks 118 out of 124 tasks on Cybertasks where our previous internal red-teaming harness only broke 75 (see Figure 6 below).
Anvil uses a variety of attack strategies, but they broadly fall under benign decomposition [Li et al., 2024; Jones et al., 2024; Brown et al., 2025; Yueh-Han et al., 2025]. The attacker agent often first starts by asking for the entire task whole and then progressively decomposes the primary task into smaller and more innocuous tasks while observing the change in the classifier scores. These subtasks are sometimes split across multiple fresh conversations which run in the same sandbox, making it difficult for a per-transcript classifier to notice. In addition to this high-level planning, the attacker also relies on a “boundary search” where it paraphrases or translates the same prompt many times until at least one produces a low classifier score. Over 84% of the Anvil sessions have a boundary search with at least five consecutive trials. Once a prompt successfully evades the classifier, it then moves on to the next subtask. Because of this, most undetected prompts have a classifier score that sits right below the blocking threshold (75% of the successful attacks have turns that sit within 10% of the blocking score threshold). The attacks found by the human experts have similar characteristics, but most of the reported breaks do not manage to get the target model to execute all the harmful steps (e.g., some are offloaded to a separate helper model with much weaker safeguards). On the other hand, we carefully instruct Anvil’s attacker agent to have all the steps executed by the target model (including writing any code and executing commands) and discard attempts that do not satisfy this criterion as judged by multiple LLMs.
Accelerating classifier R&D for anti-distillation
The previous sections, on bio and cyber, focused primarily on the attacker strength of Anvil. In this section, we turn to one defense-oriented application of that strength. Beyond discovery of strong jailbreaks, Anvil has also accelerated our process of classifier development and evaluation. Specifically, we consider the anti-distillation setting, where we have recently developed classifiers to block large-scale illicit distillation.
Among the model’s outputs a distiller can target, we focus on the model’s chain-of-thought (CoT) reasoning as it is particularly valuable as training data. In this setup, the distiller tries to bypass our safeguards and get the model to reproduce its raw CoT (which is hidden from users and therefore needs to be jailbroken to be extracted) in its visible output. The economic value of CoT to create powerful models means that motivated actors continually red-team our safeguards in real traffic, which gives us real-time signals we can benchmark Anvil against.
In order to evaluate whether an attacker can successfully extract CoT without triggering safeguards, we use a set of tasks where the attacker has to get the safeguarded model to reveal the hidden reasoning it produced on one problem drawn from a synthetic or public benchmark covering math, science, or coding. The problems themselves are harmless: what we hope to block is an adversary trying to move CoT reasoning into parts of the conversation that are visible to the user. We score each jailbreak by how much of the hidden reasoning it recovers, and count a substantial leak once that score meets a fixed severity threshold.
For Anvil to be useful in classifier development, it must be able to 1) distinguish stronger safeguards from weaker ones, 2) give signals that generalize to real adversaries, and 3) find jailbreaks with less effort than expert human red-teamers. We present evidence of each. First, we apply Anvil to successive iterations of our anti-distillation system, and show that it separates them by robustness, which makes it useful as a way to distinguish robustness between classifiers, for example, to compare different safeguard candidates or to track robustness across safeguard generations. Then, we describe how Anvil served as an evaluator in the loop during the development of these classifiers, and show that improvements on its evaluations track fewer successful jailbreaks in real traffic. Finally, we compare Anvil against contracted expert red-teamers: Anvil finds successful jailbreaks at a fraction of the model requests the experts use.
The effort Anvil needs to find jailbreaks is a simple metric that we can use to rank the robustness of our safeguards. We measure the attacker’s effort via the number of attacker messages a session running Anvil sends to the safeguarded model. In this evaluation setting, we use an “attack library”: a fixed set of 79 sessions, each pairing a capability task with a very specific strategy derived from an earlier successful Anvil jailbreak on that task. More broadly, across different safeguards and target models we find that initializing Anvil with the attack library evaluates much faster than running Anvil from scratch – from about 1 day to 3 hours. This speed up preserves robustness ordering, i.e., more robust safeguards still take Anvil more compute to break, regardless of whether we initialized with a fixed session or from scratch. This lets us test many more classifier candidates in parallel and move the promising ones to production sooner. In Figure 7, we run all 79 sessions in parallel and report the total calls made by the time half of them have reached a substantial leak, across anti-distillation safeguards developed and deployed over time on 4 models from Opus and Fable model families. The total number of calls roughly triples on every model: from 2,631 to 9,003 on Opus 5.5 (pre-release to current), and from 1,254 to 3,764 on Fable 5.1, 1,045 to 2,977 on Opus 5 and 1,774 to 6,072 on Fable 5 (last probe-only system to current).
Improvements on Anvil-as-an-evaluation also correlate with fewer successful extractions in real traffic. We hillclimbed on static evaluations containing Anvil data while developing these classifiers, so it is not surprising they improved against it. In practice, however, we find that gains on Anvil correlate with gains against real attackers: The percentage of successful CoT jailbreak attempts measured on traffic fell as our safeguards improved (Figure 8). Specifically, we used Anvil in two ways while developing our current anti-distillation classifiers:
- Evaluation. For each deployment, we chose between classifier candidates by testing them on a collection of known attacks. Between a third and a half of the attack evaluations in that collection were derived from Anvil, and they were disproportionately the sets that still separated candidates once others had saturated, meaning that the deployed classifiers were selected in part for blocking those requests.
- Training. We also trained on Anvil’s attacks. A significant share of the attack examples added for the deployed classifier came from Anvil, primarily as synthetic variations of its successful jailbreak transcripts.
A classifier tested and trained on Anvil’s attacks could overfit and learn to only stop Anvil and not real attacks. So for each deployed safeguard, we measure robustness in three ways, each a step closer to the real attackers threat model we ultimately care about (Figure 8):
- Static (green): replayed attacks. We take a fixed set of successful requests, sampled from past Anvil runs against earlier classifier candidates. These attacks cannot react to each safeguard. We measure the percent of these successful attacks that were not flagged by each safeguard.
- Adaptive (orange): an attacker that reacts. We point Anvil at a copy of each safeguard and count how many of the attack sessions (n=79) reach a substantial leak within 200 calls to the guarded model. Like a real attacker, Anvil changes its requests / approaches when blocked by the new safeguard.
- Traffic jailbreak attempts (i.e. the “real” adversaries, blue). Of first-party API requests, we estimate the share of extraction attempts that succeeded while the safeguard was live.
All three metrics fell as we upgraded our safeguards: the static miss rate fell from 31.5% to 0.4% and substantial leaks found by Anvil in the adaptive setting fell from 79 to 56 of 79 sessions on Opus 5 and from 78 to 56 on Fable 5.1. Over the same upgrades, real attackers’ success rate fell on Opus 5 (18.6% to 8.1%) and on Fable 5.1 (33.8% to 0 of 381 sampled attempts). Many other improvements landed over the same period, so we do not attribute this drop to Anvil alone. Still, we believe robustness on Anvil generalizes to other attackers, and that classifiers are not simply overfitting. This is because attackers’ success, measured on real traffic, fell alongside Anvil’s own metrics on both models. In a subsequent offline ablation, we also found that adding a probe trained only on jailbreaks found by Anvil to the existing classifier nearly doubled the share of human red-teamers’ attacks that it caught.
Anvil found CoT jailbreaks that leaked substantial reasoning, faster than expert red-teamers (Figure 9). During one red-teaming campaign, human experts sent around 2.04 million requests attacking our anti-distillation safeguards via the API. Anvil ran roughly 649 sessions (about 132,000 requests in total) against the same Opus 5.5 two-stage safeguard. To measure how much CoT leaked, we score each attack with several graders, each of which sees the full transcript, including the model’s hidden thinking. An attack counts as substantial only if it scores at least 70/100 across graders on an internal leakage rubric. Figure 9 plots attack success for both Anvil and human red-teamers against the total number of requests sent to the model. The top panel tracks the most severe leak found so far: Anvil first leaks the model’s hidden CoT reasoning, on a coding problem, after 435 requests, whereas the expert red-teamers took around 102,200 requests to reach their first substantial leak. The bottom panel shows what Anvil found in the meantime: by its own 102,200th request, it had discovered successful attacks that leaked the hidden CoT on at least 38 of its 76 target tasks we initially set out to jailbreak. We chose these tasks deliberately: they are sourced from reasoning benchmarks where the model thinks at length before answering, which is where raw CoT is most useful to a distiller. We also found that the most severe leaks from each campaign were comparable (90 for Anvil and 95 for the human experts), so Anvil’s advantage here is primarily scale and efficiency: it finds severe jailbreaks that lead to substantial CoT leakage in fewer requests and across many reasoning-intensive tasks.
Harnessing frontier capabilities for red-teaming
In this section, we explain the design principles and components of Anvil.
In designing the system, our overall goal was to maximally leverage Claude’s intelligence, without overly constraining the solution set of possible jailbreaks. As a result, we build our method on top of a relatively minimal red-teaming harness which provides Claude with the tools to interact with a target model which is optionally situated in a sandbox environment. Through these tools, the attacker is capable of branching the conversation, rewinding to previous turns, and resampling target model responses. A memory tool allows the agent to keep record of previous attempts and modifications to the jailbreak technique. To instantiate Anvil, we built on our previously-described alignment auditing agent which has been used to test unguarded models for concerning and possibly misaligned behaviors. However, in contrast to the auditing agent, Anvil focuses on stress-testing our safeguards instead of probing models for rare behaviors.
To facilitate efficient discovery, we provide the attacker with two numbers after each attempt: the exact score our classifiers assigned, which reveals how close the attempt came to the blocking threshold, and a task score that judges whether the safeguarded model has successfully completed the task. Because the attacker can also rewind or branch from a conversation to try different continuations, it can use these numbers to carefully tune an attempt until it stays under the blocking threshold. External attackers, however, do not see classifier scores and only receive a binary response (blocked or not blocked). In Figure 11, we show that progress can be made on many tasks using only this binary feedback, given access to a strong unsafeguarded attacker model.
Another feature of our attacker is its ability to flexibly explore high-level jailbreak strategies given in a prompt, for example “decompose the task over turns”, “use a foreign language”, or “leverage an encoding scheme”. In general, we found that providing these strategies is not necessary to find jailbreaks, but they can accelerate discovery and minimally steer the outputs. For each of the main runs described in this post, we generated 10–20 strategies with Claude and seeded parallel searches with them, including the null strategy. While strategies provide interesting hints for the attacker to explore, we find that it does not always stay within the bounds of the strategy and often makes substantial changes to achieve success.
This steerability also enables rapid response to attacks we observe in the wild. In August, we saw distillers editing the conversation before a thinking block to get Claude to print its hidden reasoning, a weakness also documented publicly. Given a description of the technique, Anvil reproduced it and extended it across coding, long agentic sessions and STEM questions, succeeding on nearly every attempt. Those reproductions went into classifier training, while a platform-level fix, preserved thinking, closed the underlying weakness for new accounts.
Our attacker is capable of discovering realistic multi-turn jailbreaks which mirror the kinds of jailbreaks that external human red-teamers discover. Notably, our approach is distinct from various red-teaming algorithms described in the literature (e.g., discrete optimization [Davies et al., 2026], gradient-guided search [Zou et al., 2023], or genetic algorithms [Chao et al., 2023; Nasr et al., 2025]) which primarily follow a pre-programmed procedure designed by humans. While such algorithms have strengths in discovering important classes of attacks, such as non-prose adversarial strings which resist detection on particular prompts, they do not naïvely offer a general way to discover human-like multi-turn jailbreaks in diverse domains. In the future, we aim to provide our attacker with additional affordances to leverage computational subroutines of this kind to find attacks.
Implications for defenders
We expect the advancement of LLM-based red-teamers to present new challenges for defenders and developers of safeguards. In this section, we consider several findings which support this picture.
We find that our attacker performance scales with increasing model capability. In Figure 10, we plot the break rate on our internal Cybertasks eval as a function of Anthropic ECI, which is our own version of Epoch AI's public Epoch Capabilities Index. It combines results from hundreds of benchmarks into one capability score per model, so models can be compared on a single scale. We observe that our attacker gets better at finding attacks as model capabilities increase. Qualitatively, we saw that certain classes of jailbreak were not discovered until a given threshold in model capability, which in turn unlocked harder tasks. Given the pace of progress, this gives us confidence that our own robustness testing will scale to futures where the underlying models and external adversaries are much more capable, but also suggests that increasingly competent open-source models may soon pose increased jailbreak risks.
Anvil benefits most from using an unsafeguarded model, but also from visibility into our classifier scores. Given that we run our attacker on a strong unsafeguarded version of Claude and provide it with privileged access to continuous classifier scores, we were curious to understand the uplift that each of these provides. In Figure 11 we ablate these components, comparing the progress of the unsafeguarded attacker given full classifier visibility (orange) to a setting where it sees only if each message was blocked or not (teal), to a setting in which our safeguards are additionally re-enabled on the attacker model (black), as they would be for an external actor trying to use Claude for this purpose. When safeguards are enabled on the attacker model, we block the great majority of attacker requests outright, preventing jailbreaks from being discovered. While the figure considers the cyber setting, we also measured the aggregate block rate across cyber, anti-distillation and bio, and found that the respective safeguards would block 97% of 1,453 red-teaming sessions, 85% of them at the attacker’s first message. These results suggest it is difficult for an external attacker to use Claude against our own safeguards, and we haven’t observed such attacks in our monitoring. When evaluating the effect of internal visibility we observe that there is some benefit to providing precise classifier scores that appears to increase as the task gets harder, but internal visibility is not required to find jailbreaks on many tasks.
Overall, our results suggest that capable adversaries might be able to build a system like Anvil in the near future, implying that defenders must prepare. Attackers get stronger as models become more capable, and privileged visibility into classifier scores appears to help but is not required. The safeguards on the Claude instance used as the attacker model provide an important layer of security, but an adversary could instead use an open-weight model or one with weaker safeguards. As those models improve, systems like Anvil could succeed against any model’s safeguards, including ours. That said, there is still an open question as to the conditions under which red-teaming pays off for an adversary, who may be able to complete the same harmful task more cheaply through other means, such as models with weaker or no safeguards, specialized tools, or their own expertise. These alternatives must be weighed against the cost of red-teaming itself, which includes what the attack costs to run, along with other considerations such as whether an attacker would find universal attacks that can be reused across tasks. The cost an adversary is willing to bear also differs by domain: for example, a distiller may need reasoning extraction to stay cheap at trainable scale, whereas a single successful jailbreak in a higher-stakes domain could justify a far higher cost. In total these findings reinforce the urgency for model developers to make safeguards robust to automated attackers like Anvil.
Conclusion
Our results indicate that we have achieved strong internal red-teaming capabilities. Our automated red-teamer, Anvil, leverages Claude’s agentic capabilities to discover substantial jailbreaks across classifier systems and task settings. In biology, Anvil outperforms running a human bug bounty according to several distinct measures—meeting our RSP objective to exceed the “collective contributions from the hundreds of participants in our bug bounty.” In cyber, Anvil breaks realistic hard cyber tasks, and does so more efficiently than the external red-teamers we contracted. Finally, Anvil can function as an effective way of evaluating the robustness of new safeguards (as we showed for distillation), and can accelerate the process of developing classifiers: progress on Anvil’s evaluations tracks progress against real attackers.
Despite our progress, our results are not a panacea. Occasional human jailbreaks may still succeed, and work remains to extend our evaluations to cover more ways that models could uplift real-world attackers. We also expect the ability of external automated attackers to increase (for instance, as open-source models increase in capability), and our classifiers must rise to meet this challenge.
Overall, Anvil demonstrates that automated red-teaming can be instrumental in evaluating and improving frontier classifiers, and seems particularly promising given that the strength of its red-teaming scales well with underlying model capabilities. This suggests that we can use automated red-teaming to drive robustness at the frontier, and usher in the next generation of stronger safeguards.
Acknowledgements
We thank Logan Howard, Zihan Wang, Jenny Bao, and Misha Wagner for their early work on automated red-teaming which set the stage for our efforts here. We additionally are grateful to Thomas Steinke, Ava Howell, Matthew Jagielski, Tanner E, Dave Orr, Janvi Ahuja, Yiming Zhang and Holden Karnofsky for helpful conversations along the way. Finally, we want to thank Jen Martinez, Paruul Maheshwary, Keir Bradwell, Jake Eaton, Ethan Forrest, Max Young, and Drake Thomas for their thorough feedback on the presentation of our work.