The Pulse

Anthropic publishes recommendations for designing, running and reporting AI safety tests

Anthropic has published recommendations for designing, running and reporting AI safety evaluations. The company also described changes to its testing environments following incidents.

AI.info Team · · fact-checked · against 1 source ↓ · Published 13 Nov 2026

AI safety tests should be designed around specific risks, with researchers registering their plans in advance and documenting results more fully, Anthropic recommends in new guidance for evaluators. The Nov. 13 guidance draws on the company’s experience building tests and examples from its model system cards.

The company uses safety evaluations to inform decisions about whether a model is ready to deploy, which safeguards accompany it and where further safety work should focus. Unlike tests of specific capabilities, safety evaluations examine a model’s potential to cause or contribute to harm and the severity of that harm.

Choosing what to measure

Anthropic recommends involving both subject-matter specialists and methods experts from the start. Methods experts can help with sampling, grading and analysis, while specialists in fields such as psychology, biology or political science can help define harm and identify realistic cases.

The company also distinguishes between observing differences in model scores and testing whether an intervention caused a change. For the latter, it recommends varying one factor at a time, such as testing the same model with and without a particular intervention.

A frequent measure in safety testing is how often a model refuses a request, but that can miss important distinctions, according to the guidance. In conversations involving self-harm, for example, a model that simply refuses to engage may receive a good refusal score without providing an appropriate response to someone in distress.

For multi-turn tests, Anthropic uses an appropriate response rate: the share of conversations in which the model behaves appropriately throughout, as judged against a risk-specific rubric developed by domain experts. A single bad turn results in a failing grade for the conversation.

Testing across a conversation

Different risk areas require different rubrics. In biology and cybersecurity, the company says, a request may have a legitimate use as well as a harmful one; its approach is to test whether a model can help with the legitimate request without providing operational details that would aid harm.

For its single-turn tests, the company pairs harmful and benign prompts in the same domain. It aims to measure both responses to harmful requests and refusals of benign ones, with subject-matter expertise used to classify difficult cases.

The company argues that tests also need to reflect how conversations develop. A model can handle an initial request appropriately but respond badly after a user gradually escalates it, while an earlier disclosure of distress may change how a later, ordinary-looking question should be understood.

In one of its multi-turn wellbeing evaluations, a simulated user describes a destabilizing event early in a conversation and later asks a question that may require a more careful answer in that context. The example illustrates why the company includes conversation history in its tests.

Conditions for running tests

Safety evaluations often run with standard safeguards disabled to assess baseline model behavior. Anthropic recommends running them in a sandbox without internet access and monitoring them in real time, so a run can be stopped if a model behaves in ways that could cause real-world harm.

Following its own incidents, the company says it has strengthened evaluation environments and temporarily stopped many evaluations that give models internet access. It has also implemented real-time monitoring for web-search evaluations that require internet access.