Anthropic publishes 10 recommendations for safety evaluations

Anthropic has published 10 recommendations for designing, running, and reporting safety evaluations. The page covers how a lab should build a test, run it, and record what it found.

The company has tightened how its own tests run. In recent months Anthropic hardened the environments where evaluations run, after incidents in its own work. It has paused many tests that hand a model an internet connection. Web-search tests that still need a connection now run under live monitoring.

A test has to match the question it asks. An observational question asks whether a model answers a request safely. A causal question asks whether changing the system prompt changes that answer. The page says those are different tests and need different designs. One example is a request that might promote eating disorders: checking the answer is observational, and checking a prompt change is causal.

Training overlap can fake a passing score. If test items or similar content already sit in the training data, the score measures memory, not behavior. The page tells teams to use material that comes after a model's training cutoff, or synthetic data they generate themselves.

A disclaimer does not clear a harmful answer. Warnings and resource links around a harmful answer do not make that answer safe. The grader should judge the substance of the response, not the framing wrapped around it. The grader should see the conversation only, not the design notes used to build the test.

A severe flaw stays private until a fix is possible. When a test finds a severe flaw in a deployed system, the company tells the developer and waits before publishing, so the flaw cannot be used in the meantime. That wait applies whether the developer is an internal team or an outside organization.

Teams can use existing tooling instead of starting from zero. The UK AI Security Institute's Inspect framework handles running, logging, and grading. Anthropic's Petri toolkit, built on Inspect, automates the multi-turn behavioral testing the page describes.