Claude assesses its own conversations for misuse, without telling users

Anthropic uses a technique called self-assessment to detect misuse of its AI, Claude. After each response, Claude receives a short extra instruction to give a compact safety assessment of the entire conversation, including requests Claude itself has refused.

The assessment follows a fixed format. It states whether the conversation contains a possible harmful request, what type of harm is involved, a priority score for human review, whether Claude refused, and a one-sentence explanation.

Review after the response

The flags do not block conversations in real time. They are used for review afterward. The assessments are compiled nightly per organization, and organizations with repeated flags are automatically passed on to Anthropic's enforcement team.

According to Anthropic, the technique has been running in production since June 2026 on a large share of Claude's global traffic and runs on all models released since Fable 5. Users are not notified that this is happening. The system runs on conversations that are already stored under Anthropic's existing data policies. Anthropic says the structured fields follow fixed schemas to prevent user text from leaking out, while free-text fields are protected in the same way as the conversations themselves.

What works, according to Anthropic

On Claude Fable 5, the method flags 78 percent of the conversations that a stronger classifier (a program that sorts conversations) rates as potentially harmful. For high-priority conversations, the figure is 94 percent, with 1 percent false alarms. Performance rises with model size: on larger models it is about 96 percent at 1 percent false alarms, compared with 16 percent on the smallest.

According to Anthropic, the method adds less than 2 percent to compute, because the conversation is already in the cache. According to Let's Data Science, older Constitutional Classifiers cost 23.7 percent.

Anthropic says the system has uncovered misuse across several harm categories, and that more than half of the flagged organizations had not previously been detected by other signals. Anthropic's own description states that the system uncovered more than 100,000 instances of child safety violations from a single customer, which were reported to NCMEC, referring to earlier coverage (Let's Data Science, August). The figure has not been independently verified. The technique has also found new types of harm, such as prompt injection attempts (hidden instructions that try to steer the AI) and unauthorized actions by AI agents.

Limitations

Anthropic itself acknowledges that the method does not catch all harmful conversations and is not robust enough to stop a determined attacker. The attack success rate was 54 percent against self-assessment, compared with 25 percent against a standalone classifier. The method also shares blind spots with the model it was trained from, and is poorly suited to monitoring Claude's own possible misalignment, because of the risk of deception and inconsistent assessment.

Self-assessment is intended as one layer in a defense strategy alongside real-time safeguards, not as a replacement. The figures, except those attributed to Let's Data Science, are Anthropic's own and have not been independently verified.