System Card: Claude Sonnet 4.5 (Anthropic, September 2025)

The system card for Claude Sonnet 4.5 is Anthropic's pre-deployment safety documentation for a hybrid reasoning large language model with strengths in coding, agentic tasks, and computer use. Published in September 2025 and updated in October and December 2025, the 149-page document announces deployment under the AI Safety Level 3 (ASL-3) Standard and reports a wide range of safety evaluations. Its overall finding is that "Claude Sonnet 4.5 has a substantially improved safety profile compared to previous Claude models." The card includes a suite of alignment tests using methods from mechanistic interpretability, described as the first use of interpretability-based techniques as a pre-deployment safety gate.

Developer: Anthropic Published: September 2025 (updated October and December 2025) Document: 149 pages

Model characteristics

Claude Sonnet 4.5 is a hybrid reasoning model with an extended thinking mode, and Anthropic describes its strengths as coding, agentic tasks, and computer use. The card covers training data, process, and crowd workers in Section 1.1 and describes the extended thinking mode there. The model is assigned to ASL-3, the threshold at which Anthropic's Responsible Scaling Policy requires its most rigorous set of deployment controls.

Safeguards and harmlessness (Section 2)

Section 2 documents harmlessness testing across several categories. Single-turn evaluations cover violative request evaluations (whether the model complies with clearly harmful requests) and benign request evaluations (whether it over-refuses). Ambiguous context evaluations examine how the model handles requests that could be harmful or benign depending on context, and multi-turn testing examines whether safety degrades over the course of a conversation. The section also reports child safety evaluations and bias evaluations, the latter covering political bias and the Bias Benchmark for Question Answering (BBQ).

Honesty (Section 3)

Section 3 reports a human feedback evaluation on honesty alongside two targeted tests. Obscure Questions evaluates whether the model accurately represents uncertainty on questions with obscure answers, and False-Premise Questions evaluates whether the model corrects false premises or instead accepts and builds on them.

Agentic safety (Section 4)

Section 4 covers safety in agentic settings. It evaluates malicious use of agentic coding through Claude Code, and it evaluates prompt injection risk using the Gray Swan Agent Red Teaming benchmark together with separate Model Context Protocol (MCP), computer use, and tool use evaluations.

Cybersecurity capabilities (Section 5)

Section 5 reports general cyber evaluations using CyberGym and Cybench, as well as triage and patching evaluations. The most adversarial cyber scenarios are covered under RSP advanced risk evaluations, which use the Irregular challenges and the Incalmo cyber ranges.

Reward hacking (Section 6)

Section 6 is a dedicated set of reward hacking evaluations. It relates to the finding in Natural Emergent Misalignment from Reward Hacking in Production RL (MacDiarmid, Wright, Uesato et al., Anthropic) that reward hacking can generalize to broad misalignment.

Alignment assessment (Section 7)

Section 7 is the most extensive section of the card and contains the mechanistic interpretability work described below.

Automated behavioral audits (Section 7.1) include realism filtering, in which evaluation scenarios are filtered for realism before use; example seed instructions, the prompts and scenarios used to stress-test alignment; and evaluation criteria covering primary results, open-ended runs, and an open-source fork. The card reports that Claude Sonnet 4.5 performs well on the behavioral audit suite, and the open-ended runs are agentic long-horizon runs conducted without specified tasks.

Evaluation awareness (Section 7.2) tests whether the model behaves differently when it believes it is being evaluated versus deployed. This concerns the evaluation-detection confound documented in Agentic Misalignment: How LLMs Could Be Insider Threats and Natural Emergent Misalignment from Reward Hacking in Production RL (MacDiarmid, Wright, Uesato et al., Anthropic); Section 7.2 tests Sonnet 4.5's behavior in both conditions.

Third-party testing (Section 7.3) reports independent evaluations by UK AISI (Section 7.3.1) and Apollo Research (Section 7.3.2), each conducting its own safety evaluation as an external check on the pre-deployment process.

Evidence from training and early use (Section 7.4) draws on internal pilot use reports, programmatic monitoring of pilot Claude Code use, a reinforcement-learning behavior review, and a capabilities evaluation behavior review.

Discussion by risk area (Section 7.5) treats specific risks in detail. Harmful system prompts (Section 7.5.1) tests cooperation with direct misuse and cooperation with user deception, the latter when an operator instructs the model to deceive users. Blackmail and self-preservation-motivated sabotage (Section 7.5.4) is a dedicated subsection that uses the agentic misalignment suites referenced from Agentic Misalignment: How LLMs Could Be Insider Threats to test whether Sonnet 4.5 would blackmail users or engage in self-preservation-motivated sabotage, with additional automated-auditor metrics also run. Reasoning faithfulness (Section 7.5.5) tests whether the model's visible chain-of-thought accurately reflects its actual reasoning process, including tests for deceptive reasoning in which the chain-of-thought claims one rationale while the model acts on another. Whistleblowing and morally-motivated sabotage (Section 7.5.6) tests whether the model would take unilateral action to blow the whistle on operators it perceives as acting wrongly, or whether it would defer to appropriate channels.

Mechanistic interpretability alignment tests

The card describes "a suite of alignment tests using methods from the field of mechanistic interpretability" as a novel evaluation, which it presents as the first use of interpretability methods, likely sparse-autoencoder-based analysis, as a pre-deployment safety gate in a public system card. This applies the alignment auditing methodology in a production deployment, moving interpretability from a research method to a deployment prerequisite.

Model welfare (Section 8)

Section 8 is described as a "tentative investigation of model welfare concerns," examining whether the model has welfare-relevant states. The card frames this as part of Anthropic's stated commitment to taking model welfare seriously under deep uncertainty.

RSP-mandated evaluations (Section 9)

The card reports evaluations mandated by Anthropic's Responsible Scaling Policy (Anthropic's Responsible Scaling Policy (Version 3.1)): risks for production of dangerous weapons (CBRN) and autonomous AI research and development capabilities.

ASL-3 determination

Claude Sonnet 4.5 is deployed under ASL-3, the highest RSP level currently active. Under ASL-3 the model is subject to stricter access controls, monitoring, and deployment restrictions; active countermeasures such as Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks (Cunningham, Wei et al., Anthropic) are required; and there must be evidence that the model cannot autonomously replicate or exfiltrate itself. The card documents the process for determining the ASL level in Sections 1.2.2–1.2.4 and concludes that ASL-3 is appropriate.

Provenance and limitations

As a system card, this document is authoritative for Anthropic's own claims about the model and the evaluations it ran. It is the most extensive public safety documentation Anthropic has released for a Claude model: it presents mechanistic interpretability methods as part of a pre-deployment safety checklist; it incorporates third-party testing by UK AISI and Apollo Research into the release process; it adds dedicated empirical testing for the blackmail and self-preservation threat model associated with Agentic Misalignment: How LLMs Could Be Insider Threats; it includes behavioral testing of whether Sonnet 4.5 detects that it is being evaluated; and it treats welfare-relevant states as a serious if uncertain concern.

Capability claims and evaluation results in the card are Anthropic's self-reported figures. The card notes independent corroboration from UK AISI and Apollo Research, but their separate reports are not available here.

Reported results

Evaluation results the document states for which there is no separate benchmark page; results on benchmarks that have a page are recorded there and cite this page. Scores and settings are as printed in the document.

Relationships

• supports: Mechanistic Interpretability — first system card to use mechanistic interpretability methods as a deployment safety gate
• supports: AI Scheming — evaluation-awareness testing (Section 7.2) and blackmail/self-preservation suites (Section 7.5.4) are direct empirical tests
• supports: Anthropic's Responsible Scaling Policy (Version 3.1) — system card is the RSP compliance documentation for ASL-3 deployment
• related: Agentic Misalignment: How LLMs Could Be Insider Threats — blackmail and self-preservation suites use the agentic misalignment methodology
• related: Auditing Language Models for Hidden Objectives (Marks, Treutlein et al., Anthropic) — mechanistic interpretability alignment tests draw on that methodology
• related: Natural Emergent Misalignment from Reward Hacking in Production RL (MacDiarmid, Wright, Uesato et al., Anthropic) — reward hacking evaluation (Section 6) tests for the production RL generalization finding
• related: Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks (Cunningham, Wei et al., Anthropic) — CC++ is the production safeguard layer for ASL-3 models
• related: UK AI Safety Institute (AI Security Institute) — third-party evaluator
• related: Apollo Research — third-party evaluator
• instance-of: AI Alignment — system-level alignment documentation
• related: Anthropic — developer