Anthropic / Wikimedia Commons (Public domain)
A post-response self-assessment adds another safety layer to Claude, designed to catch attacks that slip past real-time defenses
Anthropic has taught Claude to look back over a conversation after it responds and judge whether someone may be trying to misuse it.
The idea is that the model gets a second look at every exchange. Real-time filters still try to block bad requests up front. This new check asks a different question once the answer is already out: was that a trick?
How the self-assessment works #
The feature runs as a post-response evaluation. Claude finishes answering, then produces a short internal assessment of whether the conversation shows signs of potential misuse.
The assessment does not interrupt the user. Nobody sees a pop-up or a sudden refusal mid-chat. Flagged interactions are instead routed for offline review by humans.
The feature applies to all Claude models released since the Fable 5 wave in June 2026.
It is also cheap to run. Each assessment adds approximately 10 tokens, and the feature adds less than 2% to inference costs.
For anyone unfamiliar with the jargon, tokens are the small chunks of text that AI models read and write. Inference is the compute spent every time a model answers a prompt. So the check is a few extra words of internal notes per conversation, with a modest effect on the bill.
The detection numbers #
Anthropic reports the self-assessment system flagged 78% of potentially harmful conversations.
Performance on the most serious cases was stronger. The system achieved 94% detection of high-priority cases, with a false-positive rate of roughly 1%.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
That last figure matters as much as the headline catch rates. A safety system that flags everything is useless, because human reviewers drown in noise. A false-positive rate near 1% means most of what lands in the review queue is likely worth a look.
The 78% figure also implies that a meaningful share of potentially harmful conversations still go unflagged by this layer. That is why Anthropic positions it as one tool among several rather than a complete fix.
Part of a defense-in-depth strategy #
The feature fits into Anthropic’s broader defense-in-depth approach to safety. The concept is borrowed from security engineering: stack several imperfect safeguards so that a failure in one is caught by another.
Here, the self-assessment complements existing real-time safeguards. Those front-line controls aim to stop harmful requests before Claude answers. The post-response check targets attacks that get through anyway.
Because the review happens offline, the approach also avoids a classic trade-off. Tighter real-time filters tend to annoy legitimate users with refusals. A background check can watch for abuse without making everyday conversations worse.
Background: Anthropic’s push on outside scrutiny #
The rollout follows Anthropic’s expansion of third-party evaluator access, announced in October 2026.
The company has worked with outside organizations including METR and SecureBio to strengthen external evaluation of AI safety. Those partnerships are meant to let independent groups test models rather than relying only on Anthropic’s own claims.
Anthropic has also published regular evaluations and disclosures on potential misuse of its models. The company has addressed instances of unintended model behavior publicly, an approach that turns safety work into an ongoing process rather than a one-time certification.
The self-assessment feature extends that pattern inward. External evaluators probe the model from outside. The new check lets the model contribute to monitoring its own deployments.
What this means #
For businesses deploying Claude, the most practical takeaway is the cost profile. A safety layer that adds less than 2% to inference costs is unlikely to change the economics of most deployments. The model flags, people decide. Keeping humans in the loop for flagged cases gives Anthropic a way to learn from new attack patterns and feed those lessons back into its other safeguards.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.