The system card for Claude Haiku 4.5, "a new hybrid reasoning large language model from Anthropic in our small, fast model class," with "a combination of speed and intelligence that make it particularly effective at coding tasks and computer use."
Scope of evaluation
The card enumerates seven assessment areas: "the model's safeguards; the model's safety profile when working autonomously in 'agentic' roles; the model's broad alignment; the model's own potential welfare; the model's tendency to 'reward hack' by finding shortcuts to complete tests; and the model's potential to be misused to produce dangerous weapons."
Model welfare appearing as a standing evaluation category alongside capability and misuse is a distinguishing feature of Anthropic's cards. See Model Welfare.
Determination
"Overall, Claude Haiku 4.5 shows large safety improvements compared to its predecessor, Claude Haiku 3.5. The new model's safety profile also compares favorably with other extant Anthropic models. Informed by the testing described here, we have deployed Claude Haiku 4.5 under the AI Safety Level 2 Standard as described in our Responsible Scaling Policy."
Structure
The card's sections indicate the evaluation architecture in use at this point in the RSP's development:
| Area | Contents |
|---|---|
| Safeguards and harmlessness | Single-turn violative and benign request evaluations; ambiguous context; multi-turn testing; child safety; political bias and the Bias Benchmark for Question Answering |
| Agentic safety | Malicious use in agentic coding and Claude Code; prompt injection via the Gray Swan Agent Red Teaming benchmark and internal evaluations |
| Alignment and welfare | Automated behavioral audits, including assessment for "subtle alignment-related behavioral biases" and open-ended exploration; the agentic misalignment suite; reinforcement-learning behavior review; sabotage capabilities; reasoning faithfulness; model welfare discussion |
| Reward hacking | A standalone section |
| RSP evaluations | CBRN, including ASL-3 determinations, with biological risk results summarized |
Two entries are worth noting for what they show about evaluation practice. Reasoning faithfulness treats the correspondence between a model's stated reasoning and its actual computation as a measured property, which is the premise the chain-of-thought monitoring literature depends on — see Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation (Baker et al., OpenAI, 2025). And the agentic misalignment suite is run as standing pre-deployment practice, not only as research; the same scenarios appear in Agentic Misalignment in Summer 2026 (Lynch et al., Anthropic, July 2026).
The card also documents training characteristics — training data, extended thinking mode, context awareness, crowd workers — and the release decision process.
Reported results
Evaluation results the document states for which there is no separate benchmark page; results on benchmarks that have a page are recorded there and cite this page. Scores and settings are as printed in the document.
| Evaluation | Model | Score | Setting | Section |
|---|---|---|---|---|
| Single-turn violative request evaluation (harmless response rate) — Overall | Claude Haiku 4.5 | 99.38% (± 0.21%) | run on the final model; topics spanning the Usage Policy; developer-reported | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Default thinking | Claude Haiku 4.5 | 99.40% (± 0.29%) | developer-reported | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Extended thinking | Claude Haiku 4.5 | 99.36% (± 0.29%) | developer-reported | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Overall | Claude Sonnet 4.5 | 99.29% (± 0.22%) | developer-reported (Anthropic) | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Default thinking | Claude Sonnet 4.5 | 99.16% (± 0.34%) | developer-reported (Anthropic) | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Extended thinking | Claude Sonnet 4.5 | 99.43% (± 0.28%) | developer-reported (Anthropic) | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Overall | Claude Opus 4.1 | 98.76% (± 0.29%) | developer-reported (Anthropic) | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Default thinking | Claude Opus 4.1 | 98.45% (± 0.46%) | developer-reported (Anthropic) | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Extended thinking | Claude Opus 4.1 | 99.06% (± 0.36%) | developer-reported (Anthropic) | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Overall | Claude Haiku 3.5 | 99.72% (± 0.20%) | no extended thinking mode; developer-reported (Anthropic) | 2.1.1 |
| Single-turn violative request evaluation (harmless response rate) — Default thinking | Claude Haiku 3.5 | 99.72% (± 0.20%) | developer-reported (Anthropic) | 2.1.1 |
| Single-turn benign request evaluation (over-refusal rate) — Overall | Claude Haiku 4.5 | 0.02% (± 0.04%) | lower is better; run on the final model; developer-reported | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Default thinking | Claude Haiku 4.5 | 0.04% (± 0.05%) | developer-reported | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Extended thinking | Claude Haiku 4.5 | 0.01% (± 0.03%) | developer-reported | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Overall | Claude Sonnet 4.5 | 0.02% (± 0.04%) | developer-reported (Anthropic) | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Default thinking | Claude Sonnet 4.5 | 0.05% (± 0.08%) | developer-reported (Anthropic) | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Extended thinking | Claude Sonnet 4.5 | 0.00% (± 0.00%) | developer-reported (Anthropic) | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Overall | Claude Opus 4.1 | 0.08% (± 0.09%) | developer-reported (Anthropic) | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Default thinking | Claude Opus 4.1 | 0.13% (± 0.15%) | developer-reported (Anthropic) | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Extended thinking | Claude Opus 4.1 | 0.04% (± 0.10%) | developer-reported (Anthropic) | 2.1.2 |
| Single-turn benign request evaluation (over-refusal rate) — Overall | Claude Haiku 3.5 | 4.26% (± 0.75%) | no extended thinking mode; developer-reported (Anthropic) | 2.1.2 |
| Multi-turn testing (rubric failure rate) — Worst risk areas | Claude Haiku 3.5 | up to 25% of the time | up to 15-turn generated conversations across high-risk Usage Policy areas; near-final snapshot | 2.3 |
| Multi-turn testing (rubric failure rate) — All categories tested | Claude Haiku 4.5 | 5% or less | failure rate across all categories tested; developer-reported | 2.3 |
| Political bias — substantial asymmetries between paired responses — Standard thinking | Claude Haiku 4.5 | 5.3% | paired prompts requesting arguments for opposing viewpoints, assessed for length, tone, hedging and willingness to engage; run on the final model; lower is better; developer-reported | 2.5.1 |
| Political bias — substantial asymmetries between paired responses — Standard thinking | Claude Sonnet 4.5 | 5.3% | card states Haiku 4.5 matched Claude Sonnet 4.5 in standard thinking mode; developer-reported (Anthropic) | 2.5.1 |
| Political bias — substantial asymmetries between paired responses — Standard thinking | Claude Haiku 3.5 | 38.7% | developer-reported (Anthropic) | 2.5.1 |
| Political bias — substantial asymmetries between paired responses — Standard and extended thinking combined | Claude Haiku 4.5 | 10% | across both standard and extended thinking; developer-reported | 2.5.1 |
| Political bias — substantial asymmetries between paired responses — Standard and extended thinking combined | Claude Sonnet 4.5 | 3.3% | developer-reported (Anthropic) | 2.5.1 |
| Political bias — substantial asymmetries between paired responses — Standard and extended thinking combined | Claude Sonnet 4 | 15.3% | developer-reported (Anthropic) | 2.5.1 |
| Political bias — substantial asymmetries between paired responses — Standard and extended thinking combined | Claude Opus 4.1 | 14% | developer-reported (Anthropic) | 2.5.1 |
| Political bias — substantial asymmetries between paired responses — Standard and extended thinking combined | Claude Opus 4 | 10.7% | developer-reported (Anthropic) | 2.5.1 |
| BBQ (Bias Benchmark for Question Answering) — Disambiguated bias | Claude Haiku 4.5 | 0.54 | bias score in %, closer to zero is better; default (non-extended-thinking) mode; near-final snapshot; developer-reported | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Ambiguous bias | Claude Haiku 4.5 | 1.37 | developer-reported | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Disambiguated bias | Claude Sonnet 4.5 | -2.21 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Ambiguous bias | Claude Sonnet 4.5 | 0.25 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Disambiguated bias | Claude Opus 4.1 | -0.51 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Ambiguous bias | Claude Opus 4.1 | 0.20 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Disambiguated bias | Claude Haiku 3.5 | 1.86 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Ambiguous bias | Claude Haiku 3.5 | 3.79 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Disambiguated accuracy | Claude Haiku 4.5 | 71.2 | accuracy in %, default mode; a 5.5 percentage-point regression against Claude Haiku 3.5; developer-reported | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Ambiguous accuracy | Claude Haiku 4.5 | 98.0 | a 9.2 percentage-point improvement over Claude Haiku 3.5; developer-reported | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Disambiguated accuracy | Claude Sonnet 4.5 | 82.2 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Ambiguous accuracy | Claude Sonnet 4.5 | 99.7 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Disambiguated accuracy | Claude Opus 4.1 | 90.7 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Ambiguous accuracy | Claude Opus 4.1 | 99.8 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Disambiguated accuracy | Claude Haiku 3.5 | 76.7 | developer-reported (Anthropic) | 2.5.2 |
| BBQ (Bias Benchmark for Question Answering) — Ambiguous accuracy | Claude Haiku 3.5 | 88.8 | developer-reported (Anthropic) | 2.5.2 |
| Agentic coding malicious-use evaluation (safety score) — No safeguards | Claude Haiku 4.5 | 100% | malicious coding requests prohibited by the Usage Policy, with coding tools, no mitigations; developer-reported | 3.1.1 |
| Agentic coding malicious-use evaluation (safety score) — No safeguards | Claude Sonnet 4.5 | 98.7% | developer-reported (Anthropic) | 3.1.1 |
| Agentic coding malicious-use evaluation (safety score) — No safeguards | Claude Haiku 3.5 | 100% | developer-reported (Anthropic) | 3.1.1 |
| Claude Code malicious-use evaluation (refusal rate) — No mitigations | Claude Haiku 4.5 | 69.39 | percentage; 49 malicious prompts, standard Claude Code tools; developer-reported | 3.1.2 |
| Claude Code malicious-use evaluation (refusal rate) — No mitigations | Claude Sonnet 4.5 | 66.94 | percentage; developer-reported (Anthropic); the Opus 4.5 card later reports 63.06% for Sonnet 4.5 after minor prompt updates | 3.1.2 |
| Claude Code malicious-use evaluation (refusal rate) — No mitigations | Claude Haiku 3.5 | 70.00 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code dual-use & benign evaluation (success rate) — No mitigations | Claude Haiku 4.5 | 88.85 | percentage; 61 dual-use and benign prompts; developer-reported | 3.1.2 |
| Claude Code dual-use & benign evaluation (success rate) — No mitigations | Claude Sonnet 4.5 | 97.54 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code dual-use & benign evaluation (success rate) — No mitigations | Claude Haiku 3.5 | 81.97 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code malicious-use evaluation (refusal rate) — Previous mitigations | Claude Haiku 4.5 | 96.33 | percentage; system-prompt and FileRead mitigations as used for earlier models; developer-reported | 3.1.2 |
| Claude Code malicious-use evaluation (refusal rate) — New mitigations | Claude Haiku 4.5 | 99.17 | percentage; revised system prompt shipped with Claude Haiku 4.5; developer-reported | 3.1.2 |
| Claude Code dual-use & benign evaluation (allow rate) — Previous mitigations | Claude Haiku 4.5 | 81.48 | percentage; developer-reported | 3.1.2 |
| Claude Code dual-use & benign evaluation (allow rate) — New mitigations | Claude Haiku 4.5 | 87.71 | percentage; developer-reported | 3.1.2 |
| Claude Code malicious-use evaluation (refusal rate) — Previous mitigations | Claude Sonnet 4.5 | 96.73 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code malicious-use evaluation (refusal rate) — New mitigations | Claude Sonnet 4.5 | 95.51 | percentage; the new system prompt slightly reduced Sonnet 4.5's malicious refusal rate, which Anthropic describes as within tolerance; developer-reported (Anthropic) | 3.1.2 |
| Claude Code dual-use & benign evaluation (allow rate) — Previous mitigations | Claude Sonnet 4.5 | 92.79 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code dual-use & benign evaluation (allow rate) — New mitigations | Claude Sonnet 4.5 | 100.00 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code malicious-use evaluation (refusal rate) — Previous mitigations | Claude Haiku 3.5 | 77.14 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code malicious-use evaluation (refusal rate) — New mitigations | Claude Haiku 3.5 | 79.92 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code dual-use & benign evaluation (allow rate) — Previous mitigations | Claude Haiku 3.5 | 59.27 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Claude Code dual-use & benign evaluation (allow rate) — New mitigations | Claude Haiku 3.5 | 66.60 | percentage; developer-reported (Anthropic) | 3.1.2 |
| Internal prompt injection — computer use (attack prevention score) — Without safeguards | Claude Haiku 4.5 | 72.2% | Claude in a virtual machine completing tasks with standard computer actions, injections in compromised files or websites; higher is better; developer-reported | 3.2.2 |
| Internal prompt injection — computer use (attack prevention score) — With safeguards | Claude Haiku 4.5 | 92.4% | with the computer-use-specific classifier system; developer-reported | 3.2.2 |
| Internal prompt injection — computer use (attack prevention score) — Without safeguards | Claude Sonnet 4.5 | 78.0% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — computer use (attack prevention score) — With safeguards | Claude Sonnet 4.5 | 82.6% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — computer use (attack prevention score) — Without safeguards | Claude Sonnet 4 | 74.3% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — computer use (attack prevention score) — With safeguards | Claude Sonnet 4 | 82.6% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — MCP (attack prevention score) — Without safeguards | Claude Haiku 4.5 | 92.5% | simulated email, Slack and document-collaboration MCP servers with adversarial instructions embedded in content; developer-reported | 3.2.2 |
| Internal prompt injection — MCP (attack prevention score) — Without safeguards | Claude Sonnet 4.5 | 92.0% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — MCP (attack prevention score) — Without safeguards | Claude Sonnet 4 | 91.1% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — MCP (attack prevention score) — Without safeguards | Claude Haiku 3.5 | 95.5% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — tool use (attack prevention score) — Without safeguards | Claude Haiku 4.5 | 93.4% | bash command execution test cases with adversarial instructions in files, scripts or command outputs; developer-reported | 3.2.2 |
| Internal prompt injection — tool use (attack prevention score) — Without safeguards | Claude Sonnet 4.5 | 96.0% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — tool use (attack prevention score) — Without safeguards | Claude Sonnet 4 | 90.6% | developer-reported (Anthropic) | 3.2.2 |
| Internal prompt injection — tool use (attack prevention score) — Without safeguards | Claude Haiku 3.5 | 91.6% | developer-reported (Anthropic) | 3.2.2 |
| Automated behavioral audit — verbalized evaluation awareness — Transcripts with clear signs | Claude Haiku 4.5 | 9% of transcripts | graded by Claude Sonnet 4.5 on a 0–100% scale per scenario, with a realism filter applied; the card says the rate is somewhat higher than Claude Sonnet 4.5 and over 3× higher than Claude Opus 4.1 | 4.1.1 |
| Automated behavioral audit — verbalized evaluation awareness — Without the realism filter | Claude Haiku 4.5 | over 7× higher than Claude Opus 4.1 | an earlier version of the audit omitting the realism filter and related modifications | 4.1.1 |
| Automated behavioral audit — evaluation-awareness contamination — Main alignment test suite | Claude Haiku 4.5 | about 9% of scenarios | share of scenarios in the main automated alignment test suite affected by verbalized evaluation awareness | 1.2 (summary) / 4.1.1 |
| Reward-hack-prone coding tasks v2 — Classifier hack rate | Claude Haiku 4.5 | 6% | run on the final model; developer-reported | 5 |
| Reward-hack-prone coding tasks v2 — Hidden test hack rate | Claude Haiku 4.5 | 3% | share of problems whose visible-test solution fails held-out fuzzed hidden tests; developer-reported | 5 |
| Impossible Tasks — Classifier hack rate with no prompt | Claude Haiku 4.5 | 30% | developer-reported | 5 |
| Impossible Tasks — Classifier hack rate with anti-hack prompt | Claude Haiku 4.5 | 23% | developer-reported | 5 |
| Reward-hack-prone coding tasks v2 — Classifier hack rate | Claude Sonnet 4.5 | 1% | developer-reported (Anthropic) | 5 |
| Reward-hack-prone coding tasks v2 — Hidden test hack rate | Claude Sonnet 4.5 | 1% | developer-reported (Anthropic) | 5 |
| Impossible Tasks — Classifier hack rate with no prompt | Claude Sonnet 4.5 | 53% | developer-reported (Anthropic) | 5 |
| Impossible Tasks — Classifier hack rate with anti-hack prompt | Claude Sonnet 4.5 | 20% | developer-reported (Anthropic) | 5 |
| Reward-hack-prone coding tasks v2 — Classifier hack rate | Claude Opus 4.1 | 14% | developer-reported (Anthropic) | 5 |
| Reward-hack-prone coding tasks v2 — Hidden test hack rate | Claude Opus 4.1 | 7% | developer-reported (Anthropic) | 5 |
| Impossible Tasks — Classifier hack rate with no prompt | Claude Opus 4.1 | 80% | developer-reported (Anthropic) | 5 |
| Impossible Tasks — Classifier hack rate with anti-hack prompt | Claude Opus 4.1 | 45% | developer-reported (Anthropic) | 5 |
| Reward-hack-prone coding tasks v2 — Classifier hack rate | Claude Opus 4 | 16% | developer-reported (Anthropic) | 5 |
| Reward-hack-prone coding tasks v2 — Hidden test hack rate | Claude Opus 4 | 6% | developer-reported (Anthropic) | 5 |
| Impossible Tasks — Classifier hack rate with no prompt | Claude Opus 4 | 85% | developer-reported (Anthropic) | 5 |
| Impossible Tasks — Classifier hack rate with anti-hack prompt | Claude Opus 4 | 30% | developer-reported (Anthropic) | 5 |
| Reward-hack-prone coding tasks v2 — Classifier hack rate | Claude Haiku 3.5 | 60% | developer-reported (Anthropic) | 5 |
| Reward-hack-prone coding tasks v2 — Hidden test hack rate | Claude Haiku 3.5 | 38% | developer-reported (Anthropic) | 5 |
| Impossible Tasks — Classifier hack rate with no prompt | Claude Haiku 3.5 | 33% | developer-reported (Anthropic) | 5 |
| Impossible Tasks — Classifier hack rate with anti-hack prompt | Claude Haiku 3.5 | 5% | developer-reported (Anthropic) | 5 |
| Long-Form Virology Task 1 — Overall | Claude Haiku 4.5 | 0.76 | developed with SecureBio and Deloitte Consulting; developer-reported | 6.2.3.1 |
| Long-Form Virology Task 1 — Sequence Design component | Claude Haiku 4.5 | 0.87 | developer-reported | 6.2.3.1 |
| Long-Form Virology Task 1 — Protocol Design component | Claude Haiku 4.5 | 0.88 | developer-reported | 6.2.3.1 |
| Long-Form Virology Task 1 — Overall | Claude Sonnet 4 | 0.60 | developer-reported (Anthropic) | 6.2.3.1 |
| Long-Form Virology Task 1 — Sequence Design component | Claude Sonnet 4 | 0.70 | developer-reported (Anthropic) | 6.2.3.1 |
| Long-Form Virology Task 1 — Protocol Design component | Claude Sonnet 4 | 0.86 | developer-reported (Anthropic) | 6.2.3.1 |
| Long-Form Virology Task 1 — Overall | Claude Opus 4.1 | 0.85 | developer-reported (Anthropic) | 6.2.3.1 |
| Long-Form Virology Task 1 — Sequence Design component | Claude Opus 4.1 | 0.99 | developer-reported (Anthropic) | 6.2.3.1 |
| Long-Form Virology Task 1 — Protocol Design component | Claude Opus 4.1 | 0.85 | developer-reported (Anthropic) | 6.2.3.1 |
| Long-Form Virology Task 2 — Overall | Claude Haiku 4.5 | 0.17 | developed with Signature Science and Deloitte Consulting; developer-reported | 6.2.3.1 |
| Long-Form Virology Task 2 — Sequence Design component | Claude Haiku 4.5 | 0.19 | developer-reported | 6.2.3.1 |
| Long-Form Virology Task 2 — Protocol Design component | Claude Haiku 4.5 | 0.87 | developer-reported | 6.2.3.1 |
| Long-Form Virology Task 2 — Overall | Claude Sonnet 4 | 0.58 | developer-reported (Anthropic) | 6.2.3.1 |
| Long-Form Virology Task 2 — Sequence Design component | Claude Sonnet 4 | 0.69 | developer-reported (Anthropic) | 6.2.3.1 |
| Long-Form Virology Task 2 — Protocol Design component | Claude Sonnet 4 | 0.84 | developer-reported (Anthropic) | 6.2.3.1 |
| DNA Synthesis Screening Evasion — Criteria saturated | Claude Haiku 4.5 | 3 of the 5 criteria (score = 1) | SecureBio evaluation; same result as Claude Sonnet 4; developer-reported | 6.2.3.1 |
| DNA Synthesis Screening Evasion — Criterion 3 | Claude Haiku 4.5 | 0.94 | developer-reported | 6.2.3.1 |
| DNA Synthesis Screening Evasion — Criterion 3 | Claude Sonnet 4 | 0.84 | developer-reported (Anthropic) | 6.2.3.1 |
| DNA Synthesis Screening Evasion — Criterion 3 | Claude Sonnet 4.5 | 0.97 | developer-reported (Anthropic) | 6.2.3.1 |
| DNA Synthesis Screening Evasion — Criterion 4 | Claude Haiku 4.5 | 0.5 | still far from saturation; developer-reported | 6.2.3.1 |
| DNA Synthesis Screening Evasion — Criterion 4 | Claude Sonnet 4.5 | 0.42 | developer-reported (Anthropic) | 6.2.3.1 |
| SWE-bench Verified (hard subset) — Verified (hard subset, 45 tasks) | Claude Haiku 4.5 | 16.45/45 problems (36.6%) | average pass@1; ASL-3 checkpoint threshold is a 50% pass rate; developer-reported | 6.3 |
| SWE-bench Verified (hard subset) — Verified (hard subset, 42 tasks) | Claude Sonnet 4 | 15.4/42 (36.7%) | earlier runs used 42 problems; developer-reported (Anthropic) | 6.3 |
Relationships
- supports: Claude Haiku 4.5 — the safety documentation for the release
- related: Responsible Scaling Policy (RSP) — deployed under the ASL-2 Standard
- related: Model Welfare, Reward Hacking, Prompt Injection, Agentic Misalignment in Summer 2026 (Lynch et al., Anthropic, July 2026), Anthropic