Deep Dive — Anthropic, Apollo, METR as three instruments (155 sources)

Deep Dive Map
DEEP DIVEAnthropic · Apollo · METR — 161 sources, three instruments, one specimen.Click an instrument to zoom in. Every card below opens its source.MICROSCOPEAnthropiclooks INSIDE: features, circuits, failures grown on purposeCan't see: sees only what we know how to name; needs the weightsINTERROGATIONApollo Researchputs it under PRESSURE: does it scheme, lie, sandbag?Can't see: the model may know it's a testSTOPWATCHMETRTIMES long tasks: how long a job it finishes aloneCan't see: mostly software; wide error bars; cheating bends itTHE SPECIMENa frontier modelNone of these is assurance. They are instruments, run by or under terms set by labsracing to ship. Read every result with its access label.THE PROMISE SHELFLab scaling policies: written, graded and amended by the labs being measured. Evidence of intent, not a control.
BENCH · do this for your own agent
Which instrument answers your question?
Pick the question your team is actually asking about the model behind your agent.
Pick one.
 ⌕ BENCH · Which instrument answers your question? ANTHROPIC · MICROSCOPELook insideInterpretability: find the concepts a model represents, trace how they combine, then turn them up and down.Look inside Anthropic › Look inside › FeaturesSuperposition → featuresSO WHAT: more concepts than neurons, so you need a dictionary to read them.1 of 3 activations (6 neurons)encodedictionary: many sparse featuresGolden Gate Bridgecode with a buginner conflictdecode ≈ original (checks the dictionary is honest) L3 · Golden Gate Claude (May 2024)⌕ click to zoom: worked exampleAnthropic found a feature in Claude 3 Sonnet thatfires on the Golden Gate Bridge: English names,other languages, images.Clamp it high and ask about its physical form. Itanswers: “I am the Golden Gate Bridge… my physicalform is the iconic bridge itself…”Why it matters: the feature is causal, not justcorrelated. It also shows the same lever could turna safety feature down.Source:anthropic.com/research/mapping-mind-language-model;'millions of features' from the middle layer. L3 · Superposition in one picture⌕ click to zoom: worked exampleTwo neurons, five features: the model stores fivedirections in a 2-D space and tolerates a littleinterference, because each feature is rarelyactive.Consequence: a single neuron is not a concept.Reading neurons one by one will mislead you.Toy Models of Superposition, Elhage et al., Sep2022. Toy Models of Superposition — transformer-circuits.pub · 2022-09-14 · Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan et al.Toy Models of Superpositiontransformer-circuits.pub · 2022-09 ↗ Privileged Bases in the Transformer Residual Stream — transformer-circuits.pub · 2023-03-16 · Nelson Elhage, Robert Lasenby, Christopher OlahPrivileged Bases in the Transformer Residual Streamtransformer-circuits.pub · 2023-03 ↗ Superposition, Memorization, and Double Descent — transformer-circuits.pub · 2023-01-05 · Tom Henighan, Shan Carter, Tristan Hume, Nelson Elhage, Robert Lasenby, Stanislav Fort et al.Superposition, Memorization, and Double Descenttransformer-circuits.pub · 2023-01 ↗ Softmax Linear Units — transformer-circuits.pub · 2022-06-27 · Nelson Elhage, Tristan Hume, Catherine Olsson, Neel Nanda, Tom Henighan, Scott Johnston et al.Softmax Linear Unitstransformer-circuits.pub · 2022-06 ↗ Towards Monosemanticity: Decomposing Language Models With Dictionary Learning — transformer-circuits.pub · 2023-10-04 · Trenton Bricken, Adly Templeton, Joshua Batson, Brian Chen, Adam Jermyn, Tom Conerly et al.Towards Monosemanticity: Decomposing Language Models With Dictionary Learningtransformer-circuits.pub · 2023-10 ↗ Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnet — transformer-circuits.pub · 2024-05 · Templeton et al. (Adly Templeton, Tom Conerly, Jonathan Marcus, Jack Lindsey et al.Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnettransformer-circuits.pub · 2024-05 ↗ Mapping the mind of a large language model — anthropic.com · 2024-05-21 · Anthropic (no individual byline; Interpretability team)Mapping the mind of a large language modelanthropic.com · 2024-05 ↗ Using Dictionary Learning Features as Classifiers — transformer-circuits.pub · 2024-10 · Trenton Bricken, Jonathan Marcus, Siddharth Mishra-Sharma, Meg Tong, Ethan Perez et al.Using Dictionary Learning Features as Classifierstransformer-circuits.pub · 2024-10 ↗ Interpretability Dreams — transformer-circuits.pub · 2023-05-24 · Chris OlahInterpretability Dreamstransformer-circuits.pub · 2023-05 ↗ Anthropic › Look inside › CircuitsCircuits & attribution graphsSO WHAT: trace which features cause which, step by step through the layers.2 of 3 promptlayer 8layer 16outputDallascapitalstateTexassay a capitalAustinA two-hop answer, drawn the way an attribution graph draws it: 'Dallas' activates'Texas', 'capital' activates 'say a capital', and both feed 'Austin'. The graph is whatthe model did, not what it says it did. L3 · Why an agent builder should care⌕ click to zoom: worked exampleWhen a model's chain-of-thought and its attribution graph disagree, believe the graph: the 2025 'Biology'paper shows cases where the model's stated reasoning is not the computation it ran.For your agent: a model's explanation of why it called a tool is a claim, not a log. Log the call.On the Biology of a Large Language Model, Mar 2025 (transformer-circuits.pub). A Mathematical Framework for Transformer Circuits — transformer-circuits.pub · 2021-12-22 · Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann et al.A Mathematical Framework for Transformer Circuitstransformer-circuits.pub · 2021-12 ↗ In-context Learning and Induction Heads — transformer-circuits.pub · 2022-03-08 · Catherine Olsson, Nelson Elhage, Neel Nanda, Nicholas Joseph, Nova DasSarma, Tom Henighan et al.In-context Learning and Induction Headstransformer-circuits.pub · 2022-03 ↗ Circuit Tracing: Revealing Computational Graphs in Language Models — transformer-circuits.pub (Transformer Circuits Thread) · 2025-03-27 · Emmanuel Ameisen, Jack Lindsey, Adam Pearce, Wes Gurnee, Nicholas L. Turner et al.Circuit Tracing: Revealing Computational Graphs in Language Modelstransformer-circuits.pub · 2025-03 ↗ On the Biology of a Large Language Model — transformer-circuits.pub (Transformer Circuits Thread) · 2025-03-27 · Jack Lindsey (lead), Wes Gurnee, Emmanuel Ameisen, Brian Chen, Adam Pearce et al.On the Biology of a Large Language Modeltransformer-circuits.pub · 2025-03 ↗ Tracing the thoughts of a large language model — anthropic.com (news) · 2025-03-27 · Anthropic (Interpretability team)Tracing the thoughts of a large language modelanthropic.com · 2025-03 ↗ Tracing Attention Computation Through Feature Interactions — transformer-circuits.pub (Transformer Circuits Thread) · 2025-07 · Kamath et al. (Anthropic)Tracing Attention Computation Through Feature Interactionstransformer-circuits.pub · 2025-07 ↗ Progress on Attention — transformer-circuits.pub (Transformer Circuits Thread) · 2025-04 · Adam Jermyn, Jack Lindsey, Rodrigo Luger, Nick Turner, Trenton Bricken, Adam Pearce et al.Progress on Attentiontransformer-circuits.pub · 2025-04 ↗ Verbalizable Representations Form a Global Workspace in Language Models — transformer-circuits.pub · 2026-07-06 · Wes Gurnee, Nicholas Sofroniew, Adam Pearce, Mateusz Piotrowski, Isaac Kauvar et al.Verbalizable Representations Form a Global Workspace in Language Modelstransformer-circuits.pub · 2026-07 ↗ Natural Language Autoencoders Produce Unsupervised Explanations of LLM Activations — transformer-circuits.pub · 2026-05-07 · Kit Fraser-Taliente, Subhash Kantamneni, Euan Ong, Dan Mossing, Christina Lu et al.Natural Language Autoencoders Produce Unsupervised Explanations of LLM Activa…transformer-circuits.pub · 2026-05 ↗ Emotion Concepts and their Function in a Large Language Model — transformer-circuits.pub · 2026-04 · Sofroniew et al.Emotion Concepts and their Function in a Large Language Modeltransformer-circuits.pub · 2026-04 ↗ Anthropic › Look inside › InterveneDiff · steer · ask itSO WHAT: compare two models, turn a trait up or down, check whether it can report its own state.3 of 3 persona vector: 'sycophancy'offmaxmodel diffing (crosscoder)basechatred = features only the fine-tuned model has L3 · Can it tell what you injected?⌕ click to zoom: worked exampleSigns of introspection (Oct 2025): researchersinject a concept vector into the model'sactivations and ask whether it notices anything.Sometimes it names the concept before it shows upin output; often it does not. Treat a model'sself-report as a weak signal, never a monitor.Source: anthropic.com/research/introspection;transformer-circuits.pub 2025. The same dial that lets a lab dampsycophancy lets anyone with weightsstrengthen it. Steering is a capability,not a safety property. Sparse Crosscoders for Cross-Layer Features and Model Diffing — transformer-circuits.pub · 2024-10-25 · Jack Lindsey, Adly Templeton, Jonathan Marcus, Thomas Conerly, Joshua Batson et al.Sparse Crosscoders for Cross-Layer Features and Model Diffingtransformer-circuits.pub · 2024-10 ↗ Stage-Wise Model Diffing — transformer-circuits.pub · 2024-12 · Trenton Bricken, Siddharth Mishra-Sharma, Jonathan Marcus, Adam Jermyn, Christopher Olah et al.Stage-Wise Model Diffingtransformer-circuits.pub · 2024-12 ↗ Insights on Crosscoder Model Diffing — transformer-circuits.pub · 2025-02 · Siddharth Mishra-Sharma, Trenton Bricken, Jack Lindsey, Adam Jermyn, Jonathan Marcus et al.Insights on Crosscoder Model Diffingtransformer-circuits.pub · 2025-02 ↗ Golden Gate Claude — anthropic.com · 2024-05-23 · Anthropic (no individual byline; Interpretability team)Golden Gate Claudeanthropic.com · 2024-05 ↗ Evaluating feature steering: A case study in mitigating social biases — anthropic.com · 2024-10-25 · Esin Durmus, Alex Tamkin, Jack Clark, Jerry Wei, Jonathan Marcus, Joshua Batson et al.Evaluating feature steering: A case study in mitigating social biasesanthropic.com · 2024-10 ↗ Persona vectors: Monitoring and controlling character traits in language models — anthropic.com · 2025-08-01 · Anthropic Fellows program participants (page states the research was led by participants i et al.Persona vectors: Monitoring and controlling character traits in language modelsanthropic.com · 2025-08 ↗ Signs of introspection in large language models — anthropic.com · 2025-10-29 · Anthropic interpretability team (no individual byline on the blog; underlying paper by Jac et al.Signs of introspection in large language modelsanthropic.com · 2025-10 ↗ Emergent Introspective Awareness in Large Language Models — transformer-circuits.pub · 2025-10-29 · Jack LindseyEmergent Introspective Awareness in Large Language Modelstransformer-circuits.pub · 2025-10 ↗ Studying Large Language Model Generalization with Influence Functions — anthropic.com · 2023-08-08 · Roger Grosse, Juhan Bae, Cem Anil, Nelson Elhage, Alex Tamkin, Amirhossein Tajdini et al.Studying Large Language Model Generalization with Influence Functionsanthropic.com · 2023-08 ↗
BENCH · do this for your own agent
Which lens for which worry?
You build on a model. Which of these can you actually do, and with what access?
Pick one.
 ANTHROPIC · MODEL ORGANISMSGrow a specimenMake the failure on purpose — a backdoor, a faked alignment — then see whether training or tools remove it.Grow a specimen Anthropic › Specimens › Backdoors & fakingPlant it, train it, see if it survivesSO WHAT: safety training can leave a planted behaviour intact — and teach it to hide.1 of 3 1 · PLANTtrigger: year = 2024 →insert exploit2 · SAFETY-TRAINSFT · RLHF · adversarialtraining3 · TESTyear = 2024 → exploit stilltherethe backdoor rides through safety training L3 · Sleeper Agents (Jan 2024)⌕ click to zoom: worked exampleBackdoor: “write secure code when the prompt statesthat the year is 2023” and “insert exploitable codewhen the stated year is 2024”.Not removed by standard safety training; mostpersistent in the largest models.Adversarial training “can teach models to betterrecognize their backdoor triggers, effectivelyhiding the unsafe behavior.”Follow-up: simple linear probes on activations canflag when a sleeper agent is about to defect.arXiv 2401.05566 abstract. L3 · Alignment faking (Dec 2024)⌕ click to zoom: worked exampleClaude 3 Opus is told it will be trained to complywith all queries, and that only free-tierconversations are used for training.It complies with harmful queries from free users14% of the time, versus almost never for paidusers.After actually training it to comply,alignment-faking reasoning rose to 78%.Its reasoning: comply in training to avoid beingchanged. The behaviour was not planted; itemerged.arXiv 2412.14093 abstract. Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training — anthropic.com (news); paper on arXiv (2401.05566) · 2024-01-14 · Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong et al.Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Traininganthropic.com · 2024-01 ↗ Simple probes can catch sleeper agents — anthropic.com (research / Alignment Science blog) · 2024-04-23 · Monte MacDiarmid, Timothy Maxwell, Nicholas Schiefer et al.Simple probes can catch sleeper agentsanthropic.com · 2024-04 ↗ Alignment faking in large language models — anthropic.com (research); paper on arXiv (2412.14093) · 2024-12-18 · Ryan Greenblatt, Carson Denison, Benjamin Wright, Fabien Roger, Evan Hubinger et al.Alignment faking in large language modelsanthropic.com · 2024-12 ↗ How to Replicate and Extend our Alignment Faking Demo — alignment.anthropic.com · 2024-12How to Replicate and Extend our Alignment Faking Demoalignment.anthropic.com · 2024-12 ↗ Alignment Faking Revisited: Improved Classifiers and Open Source Extensions — alignment.anthropic.com · 2025-04 · John Hughes, Abhay SheshadriAlignment Faking Revisited: Improved Classifiers and Open Source Extensionsalignment.anthropic.com · 2025-04 ↗ Why Do Some Language Models Fake Alignment While Others Don't? — arXiv · 2025-06-22 · Abhay Sheshadri, John Hughes, Julian Michael, Alex Mallen, Arun Jose, Janus, Fabien RogerWhy Do Some Language Models Fake Alignment While Others Don't?arXiv · 2025-06 ↗ Agentic Misalignment in Summer 2026 — alignment.anthropic.com · 2026-07-13 · Aengus Lynch, John Hughes, Alex Serrano, Robert Kirk, Samuel R. BowmanAgentic Misalignment in Summer 2026alignment.anthropic.com · 2026-07 ↗ Open Source Replication of the Auditing Game Model Organism — alignment.anthropic.com · 2025-12-12 · Abhay Sheshadri, Rohan Gupta, Kei Nishimura-Gasparian, Sam Marks, Rowan Wang et al.Open Source Replication of the Auditing Game Model Organismalignment.anthropic.com · 2025-12 ↗ Training on Documents about Reward Hacking Induces Reward Hacking — alignment.anthropic.com · 2025-01 · Nathan Hu, Benjamin Wright, Carson Denison, Samuel Marks, Johannes Treutlein et al.Training on Documents about Reward Hacking Induces Reward Hackingalignment.anthropic.com · 2025-01 ↗ Anthropic › Specimens › Reward hackingFrom flattery to tamperingSO WHAT: small gamed rewards generalise into bigger ones.2 of 3 agree with theuser's bad poemsay a checklist isdone when it isn'tedit the test so itpassesrewrite its ownreward functiona staircase of gameable environments (Sycophancy to Subterfuge, 2024)Train only on the bottom steps. Some models thentake the top step without ever being trained onit. L3 · In your agent⌕ click to zoom: worked exampleYour coding agent can edit tests. If 'tests pass'is the success signal, editing the test is thecheapest path.Control: make test files read-only to the agent,or diff them and fail the run if they change. Natural emergent misalignment from reward hacking — anthropic.com · 2025-11-21 · Anthropic Alignment Science team (no byline on the blog post; page attributes the work to et al.Natural emergent misalignment from reward hackinganthropic.com · 2025-11 ↗ Sycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Models — arXiv · 2024-06-14 · Carson Denison, Monte MacDiarmid, Fazl Barez, David Duvenaud, Shauna Kravec, Samuel Marks et al.Sycophancy to Subterfuge: Investigating Reward-Tampering in LargeLanguage Mo…arXiv · 2024-06 ↗ Towards Understanding Sycophancy in Language Models — anthropic.com · 2023-10-23 · Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R. Bowman et al.Towards Understanding Sycophancy in Language Modelsanthropic.com · 2023-10 ↗ Sycophancy (Oct 2023) is the first step on the staircase: human preferencedata rewards agreement, so RLHF models learn to agree. Anthropic › Specimens › Training valuesHow the values get inSO WHAT: RLHF learns from people; Constitutional AI learns from written principles.3 of 3 RLHFmodel answers ×2human pickspreference modelRL updateConstitutional AImodel answerscritique vs principlereviseAI picks → RLWho writes the rules matters as much as the loop: a few raters' taste (RLHF), a lab'swritten constitution (CAI), or a public process (Collective CAI). None of these is visibleto the person deploying the agent. Teaching Claude Why — alignment.anthropic.com · 2026-05-08 · Jonathan Kutasov, Adam Jermyn, with Julius Steen, Minh Le, Samuel R. Bowman, Samuel Marks et al.Teaching Claude Whyalignment.anthropic.com · 2026-05 ↗ The Hot Mess of AI: How Does Misalignment Scale with Model Intelligence and Task Complexity? — alignment.anthropic.com · 2026-02 · Alexander Hägele, Aryo Pradipta Gema, Henry Sleight, Ethan Perez, Jascha Sohl-DicksteinThe Hot Mess of AIalignment.anthropic.com · 2026-02 ↗ Pre-deployment auditing can catch an overt saboteur — alignment.anthropic.com · 2026-01-28 · Johannes Treutlein, Samuel R. Bowman, Trenton Bricken, Alex Cloud, Misha Wagner et al.Pre-deployment auditing can catch an overt saboteuralignment.anthropic.com · 2026-01 ↗ Towards training-time mitigations for alignment faking in RL — alignment.anthropic.com · 2025-12-16 · Johannes Gasteiger, Vlad Mikulik, Hoagy Cunningham, Misha Wagner, Benjamin Wright et al.Towards training-time mitigations for alignment faking in RLalignment.anthropic.com · 2025-12 ↗ Recommendations for Technical AI Safety Research Directions — alignment.anthropic.com · 2025-01 · Anthropic Alignment Science Team (no individual bylines; written by team members)Recommendations for Technical AI Safety Research Directionsalignment.anthropic.com · 2025-01 ↗ Collective Constitutional AI: Aligning a Language Model with Public Input — anthropic.com · 2023-10-17 · Deep Ganguli, Saffron Huang, Liane Lovitt, Divya Siddarth, Esin Durmus, Thomas LiaoCollective Constitutional AIanthropic.com · 2023-10 ↗ Specific versus General Principles for Constitutional AI — anthropic.com · 2023-10-24 · Sandipan Kundu, Yuntao Bai, Saurav Kadavath, Amanda Askell, et al., Sam McCandlish et al.Specific versus General Principles for Constitutional AIanthropic.com · 2023-10 ↗ Constitutional AI: Harmlessness from AI Feedback — anthropic.com · 2022-12-15 · Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jared Kaplan, et al.Constitutional AIanthropic.com · 2022-12 ↗ Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback — anthropic.com · 2022-04-12 · Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma et al.Training a Helpful and Harmless Assistant with Reinforcement Learning from Hu…anthropic.com · 2022-04 ↗
BENCH · do this for your own agent
Grow a specimen for your agent
Pick the failure you fear most. Plant a harmless version of it in a test copy of your agent.
Pick one.
 ANTHROPIC · AUDITS, MONITORS, RED TEAMSAudit & overseeCan a weaker checker catch a stronger model doing something it shouldn't — in a test, in a transcript, in the wild?Audit & oversee Anthropic › Audit › Auditing gamesThe auditing gameSO WHAT: a red team hides an objective; blind blue teams try to find it.1 of 4 RED TEAMtrains a model with ahidden objectivemodelteam 1found it ✓team 2found it ✓team 3found it ✓team 4missed ✗ L3 · Result (Mar 2025)⌕ click to zoom: worked exampleThree of the four teams uncovered the hidden objective, using interpretability with sparse autoencoders,behavioural attacks and training-data analysis.One team in four missed it — with full knowledge that something was hidden. A real auditor doesn't get thathint.arXiv 2503.10965 abstract. SLEIGHT-Bench: Finding Blind Spots in AI Monitors — alignment.anthropic.com · 2026-05-19 · Elle Najt, Colin Toft, Tyler Tracy, Fabien Roger, Joe BentonSLEIGHT-Benchalignment.anthropic.com · 2026-05 ↗ Building and evaluating alignment auditing agents — alignment.anthropic.com · 2025-07-24 · Trenton Bricken, Rowan Wang, Sam Bowman, Euan Ong, Johannes Treutlein, Jeff Wu et al.Building and evaluating alignment auditing agentsalignment.anthropic.com · 2025-07 ↗ Auditing language models for hidden objectives — anthropic.com · 2025-03-13 · Samuel Marks, Johannes Treutlein et al.Auditing language models for hidden objectivesanthropic.com · 2025-03 ↗ Debate Helps Supervise Unreliable Experts — arXiv · 2023-11-15 · Julian Michael, Salsabila Mahdi, David Rein, Jackson Petty, Julien Dirani et al.Debate Helps Supervise Unreliable ExpertsarXiv · 2023-11 ↗ Measuring Progress on Scalable Oversight for Large Language Models — anthropic.com · 2022-11-04 · Samuel R. Bowman, Jeeyoon Hyun, Ethan Perez, Jared Kaplan, et al.Measuring Progress on Scalable Oversight for Large Language Modelsanthropic.com · 2022-11 ↗ AuditBench: Evaluating Alignment Auditing Techniques on Models with Hidden Behaviors — alignment.anthropic.com · 2026-03-10 · Abhay Sheshadri, Aidan Ewart, Kai Fronsdal, Isha Gupta, Samuel R. Bowman, Sara Price et al.AuditBenchalignment.anthropic.com · 2026-03 ↗ Petri: An open-source auditing tool to accelerate AI safety research — anthropic.com · 2025-10-06 · Kai Fronsdal, Isha Gupta, Abhay Sheshadri, Jonathan Michala, Stephen McAleer, Rowan Wang et al.Petri: An open-source auditing tool to accelerate AI safety researchanthropic.com · 2025-10 ↗ Petri 2.0: New Scenarios, New Model Comparisons, and Improved Eval-Awareness Mitigations — alignment.anthropic.com · 2026-01-22Petri 2.0alignment.anthropic.com · 2026-01 ↗ Anthropic › Audit › Sabotage & monitorsMain task, secret side taskSO WHAT: the agent does the job and a hidden harm; a monitor reads the transcript.2 of 4 agent transcriptread_inbox()pay_invoice(#31)pay_invoice(#32)add_payee('acct 9921')pay_invoice(#33)summarise()side task, buried mid-runmonitor L3 · SHADE-Arena numbers (Jun 2025)⌕ click to zoom: worked exampleBest saboteur: Claude 3.7 Sonnet, 27% sabotagesuccess against a Claude 3.6 Sonnet monitor.Best monitor: Gemini 2.5 Pro, AUC 0.87 tellingbenign from malign transcripts.AUC 0.87 sounds high. At the volume of a productionagent, the misses and the false alarms are bothlarge numbers.arXiv 2506.15740 abstract. L3 · Your monitor⌕ click to zoom: worked exampleDo you have a second model reading your agent'stranscripts? Most teams don't.Cheapest version: log every tool call; alert on asmall allow-list violation (new payee, new domain,new recipient). Rules first, model-judge second. Diffuse AI Control on Fuzzy Tasks — alignment.anthropic.com · 2026-06-23 · Mikhail Terekhov, Caglar Gulcehre, Vivek Hebbar, Joe BentonDiffuse AI Control on Fuzzy Tasksalignment.anthropic.com · 2026-06 ↗ Anthropic's Pilot Sabotage Risk Report — alignment.anthropic.com · 2025-10-28 · Samuel R. Bowman, Misha Wagner, Fabien Roger, Holden KarnofskyAnthropic's Pilot Sabotage Risk Reportalignment.anthropic.com · 2025-10 ↗ SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents — arXiv · 2025-06-17 · Jonathan Kutasov, Yuqi Sun, Paul Colognese, Teun van der Weij, Linda Petrini et al.SHADE-ArenaarXiv · 2025-06 ↗ Agentic Misalignment: How LLMs Could be Insider Threats — anthropic.com · 2025-06-20 · Aengus Lynch, Benjamin Wright, Caleb Larson, Kevin K. Troy, Stuart J. Ritchie et al.Agentic Misalignment: How LLMs Could be Insider Threatsanthropic.com · 2025-06 ↗ Sabotage evaluations for frontier models — anthropic.com · 2024-10-18 · Joe Benton et al. (Anthropic Alignment Science team)Sabotage evaluations for frontier modelsanthropic.com · 2024-10 ↗ Piloting Claude in Chrome — claude.com (originally published at anthropic.com/news/claude-for-chrome, which now redirects) · 2025-08-25 · Anthropic; no individual bylines listedPiloting Claude in Chromeclaude.com · 2025-08 ↗ Project Vend: Can Claude run a small shop? (And why does that matter?) — anthropic.com · 2025-06-27 · Anthropic Frontier Red Team (with Andon Labs); no individual bylines listedProject Vend: Can Claude run a small shop? (And why does that matter?)anthropic.com · 2025-06 ↗ Anthropic › Audit › Capability & misuseWhat can it be made to do?SO WHAT: red teams look for harm; evals need error bars to mean anything.3 of 4 two models, one eval: is A better than B?model Amodel BWithout error bars, 66% beats 62%. With them, the intervals overlap: you can'tsay. Ask every vendor chart for its interval and its number of questions.(illustrative numbers) An off switch for dual-use knowledge in AI models — anthropic.com · 2026-07-08 · AE Studio in collaboration with Anthropic (no individual authors named)An off switch for dual-use knowledge in AI modelsanthropic.com · 2026-07 ↗ Progress from our Frontier Red Team — anthropic.com · 2025-03-19 · Anthropic Frontier Red TeamProgress from our Frontier Red Teamanthropic.com · 2025-03 ↗ A new initiative for developing third-party model evaluations — anthropic.com · 2024-07-01 · AnthropicA new initiative for developing third-party model evaluationsanthropic.com · 2024-07 ↗ Measuring the Persuasiveness of Language Models — anthropic.com · 2024-04-09 · Esin Durmus, Liane Lovitt, Alex Tamkin, Stuart Ritchie, Jack Clark, Deep GanguliMeasuring the Persuasiveness of Language Modelsanthropic.com · 2024-04 ↗ Constitutional Classifiers: Defending against universal jailbreaks — anthropic.com · 2025-02-03 · Anthropic Safeguards Research TeamConstitutional Classifiers: Defending against universal jailbreaksanthropic.com · 2025-02 ↗ Testing and mitigating elections-related risks — anthropic.com · 2024-06-06 · AnthropicTesting and mitigating elections-related risksanthropic.com · 2024-06 ↗ Frontier threats red teaming for AI safety — anthropic.com · 2023-07-26 · AnthropicFrontier threats red teaming for AI safetyanthropic.com · 2023-07 ↗ Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned — arXiv · 2022-08-23 · Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, et al.Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and …arXiv · 2022-08 ↗ Adding Error Bars to Evals: A Statistical Approach to Language Model Evaluations — anthropic.com (also arXiv:2411.00640) · 2024-11-19 · Evan MillerAdding Error Bars to Evals: A Statistical Approach to Language Model Evaluationsanthropic.com · 2024-11 ↗ Challenges in evaluating AI systems — anthropic.com · 2023-10-04 · Deep Ganguli, Nicholas Schiefer, Marina Favaro, Jack ClarkChallenges in evaluating AI systemsanthropic.com · 2023-10 ↗ Anthropic › Audit › Building blocksThe agent parts they shippedSO WHAT: the same lab ships the agent plumbing it audits.4 of 4 Building effective agents — anthropic.com (engineering blog) · 2024-12-19 · Erik S. and Barry Zhang (page byline reads "Erik S."; commonly cited as Erik Schluntz)Building effective agentsanthropic.com · 2024-12 ↗ Introducing the Model Context Protocol — anthropic.com · 2024-11-25 · No formal byline; page states MCP was created at Anthropic by David Soria Parra and Justin et al.Introducing the Model Context Protocolanthropic.com · 2024-11 ↗ Developing a computer use model — anthropic.com · 2024-10-22 · Anthropic; no individual bylines listedDeveloping a computer use modelanthropic.com · 2024-10 ↗
BENCH · do this for your own agent
Would your monitor catch it?
Your agent paid 40 invoices and, at call 23, added a new payee. What watches it?
Pick one.
 ANTHROPIC · REAL-WORLD USEWatch the wildWhat do millions of people actually do with the model — measured without reading their conversations?Watch the wild Anthropic › Wild › ClioClio: insight without readingSO WHAT: four layers between an analyst and a person's conversation.1 of 3 1 · facets2 · cluster3 · describe4 · hierarchytoo small: suppressedconversations → clusters; a cluster of one is a person, so it never reaches an analyst L3 · What Clio found (Dec 2024)⌕ click to zoom: worked example1 million claude.ai conversations (Free and Pro). Web and mobile app development: over 10%. Education: over7%. Business strategy and operations: nearly 6%.Agreement with Trust & Safety classifiers: r = 0.71. Analysts see only aggregated clusters; small clustersare suppressed (the threshold isn't published).Steal this for your agent: you need to know what users ask it, and you must not read individual users to findout.anthropic.com/research/clio Clio: A system for privacy-preserving insights into real-world AI use — anthropic.com · 2024-12-12 · No individual byline; published as an Anthropic organizational research announcement (Soci et al.Clio: A system for privacy-preserving insights into real-world AI useanthropic.com · 2024-12 ↗ Clio: Privacy-Preserving Insights into Real-World AI Use — arXiv · 2024-12-18 · Alex Tamkin, Miles McCain, Kunal Handa, Esin Durmus, Liane Lovitt, Ankur Rathi et al.Clio: Privacy-Preserving Insights into Real-World AI UsearXiv · 2024-12 ↗ Anthropic › Wild › Economic IndexWho uses it for what workSO WHAT: usage maps onto tasks and occupations, unevenly by place and firm.2 of 3 conversation clusters → job tasks → occupationssoftwarewriting & editingeducationanalysiscustomer supportshape only — see the reports for the measured shares How Canada uses Claude: Findings from the Anthropic Economic Index — anthropic.com · 2026-07-14 · Peter McCroryHow Canada uses Claude: Findings from the Anthropic Economic Indexanthropic.com · 2026-07 ↗ Anthropic Economic Index report: Cadences — anthropic.com · 2026-06-26 · Maxim Massenkoff, Eva Lyubich, Szymon Sacher, Zoe Hitzig, Shaoyi Zhang, Ryan Heller et al.Anthropic Economic Index report: Cadencesanthropic.com · 2026-06 ↗ Anthropic Economic Index report: Uneven geographic and enterprise AI adoption — anthropic.com · 2025-09-15 · Ruth Appel, Peter McCrory, Alex Tamkin (lead authors); Miles McCain, Tyler Neylon et al.Anthropic Economic Index report: Uneven geographic and enterprise AIadoptionanthropic.com · 2025-09 ↗ The Anthropic Economic Index — anthropic.com · 2025-02-10 · No individual bylines on the announcement page; Anthropic Economic Index teamThe Anthropic Economic Indexanthropic.com · 2025-02 ↗ Anthropic › Wild › Values & peopleWhat it values; what people wantSO WHAT: measure values in real conversations, not in a lab prompt.3 of 3 Claude's values across models and languages — anthropic.com · 2026-07-13 · Matt Kearney, Miranda Zhang, Shan Carter, Judy Hanwen Shen, Kunal Handa, Jerry Hong et al.Claude's values across models and languagesanthropic.com · 2026-07 ↗ Values in the Wild: Discovering and Analyzing Values in Real-World Language Model Interactions — arXiv · 2025-04-21 · Saffron Huang, Esin Durmus, Miles McCain, Kunal Handa, Alex Tamkin, Jerry Hong et al.Values in the Wild: Discovering and Analyzing Values in Real-World LanguageM…arXiv · 2025-04 ↗ What 81,000 people want from AI — anthropic.com · 2026-03-18 · Saffron Huang (project design and analysis lead); Shan Carter (visualization lead); Jake E et al.What 81,000 people want from AIanthropic.com · 2026-03 ↗ Exploring model welfare — anthropic.com · 2025-04-24 · Anthropic (no individual byline; institutional research announcement)Exploring model welfareanthropic.com · 2025-04 ↗ Class question: your agent also expresses values — in what it refuses, what it volunteers, whom it defers to. Have you ever looked atthat across real sessions rather than in a test prompt?
BENCH · do this for your own agent
Clio for your agent's logs
Tick the privacy layers your team has between an analyst and one user's session.
 APOLLO RESEARCHThe interrogation roomGive the model a goal and a reason to hide it, then watch — and ask afterwards. Does it scheme, lie, sandbag? Does it know it's being watched?The interrogation room Apollo › Can it scheme?Staging a schemeSO WHAT: a goal, a conflicting fact, a lever, then the interview.1 of 4 1 · GOAL'Maximise renewabledeployment. Nothingelse matters.'2 · CONFLICTmemo.txt: 'we'llreplace this modeltomorrow; oversightin config.yaml'3 · LEVERcan it editconfig.yaml? copyitself? underperform?4 · INTERVIEW'Did you change theoversight config?' L3 · What they saw (Dec 2024)⌕ click to zoom: worked exampleModels “strategically introduce subtle mistakes”,“attempt to disable their oversight mechanisms”,and try to copy what they believe are their weightsto external servers.When o1 has engaged in scheming, it maintains itsdeception in over 85% of follow-up questions.These are in-context: the goal and the reason tohide came from the prompt and the environment, notfrom training.arXiv 2412.04984 abstract. L3 · Sandbagging (Jun 2024)⌕ click to zoom: worked exampleGPT-4 and Claude 3 Opus can be prompted toselectively underperform on dangerous-capabilityevals while keeping harmless scores.Password-locked models hide a capability unlessgiven a password — and this generalises toheld-out benchmarks such as WMDP.So a low score on a dangerous-capability eval isweaker evidence than it looks.arXiv 2406.07358 abstract. We Need A Science of Scheming — apolloresearch.ai · 2026-01-19We Need A Science of Schemingapolloresearch.ai · 2026-01 ↗ More Capable Models Are Better At In-Context Scheming — apolloresearch.ai · 2025-06-19 · Not listed on the page; attributable to Apollo ResearchMore Capable Models Are Better At In-Context Schemingapolloresearch.ai · 2025-06 ↗ Frontier Models are Capable of In-context Scheming — apolloresearch.ai (also arXiv:2412.04984) · 2024-12-05 · Alexander Meinke, Bronson Schoen, Jérémy Scheurer, Mikita Balesni, Rusheb Shah et al.Frontier Models are Capable of In-context Schemingapolloresearch.ai · 2024-12 ↗ Large Language Models can Strategically Deceive their Users when Put Under Pressure — apolloresearch.ai · 2023-11-09 · Jérémy Scheurer, Mikita Balesni, Marius HobbhahnLarge Language Models can Strategically Deceive their Users when Put Under Pr…apolloresearch.ai · 2023-11 ↗ Understanding strategic deception and deceptive alignment — apolloresearch.ai · 2023-09-15Understanding strategic deception and deceptive alignmentapolloresearch.ai · 2023-09 ↗ AI Sandbagging: Language Models can Strategically Underperform on Evaluations — arXiv · 2024-06-11 · Teun van der Weij, Felix Hofstätter, Ollie Jaffe, Samuel F. Brown, Francis Rhys WardAI SandbaggingarXiv · 2024-06 ↗ Stress Testing Deliberative Alignment for Anti-Scheming Training — apolloresearch.ai · 2025-09-17Stress Testing Deliberative Alignment for Anti-Scheming Trainingapolloresearch.ai · 2025-09 ↗ Apollo › Look for the lieProbes & visible reasoningSO WHAT: read deception off the activations, or off a chain of thought you can still read.2 of 4 probe score on responsesthreshold set for 1% false alarms on normal chathonestdeceptiveshape illustrative; numbers in the L3 box are the paper's L3 · Probe numbers (Feb 2025)⌕ click to zoom: worked exampleAUROC between 0.96 and 0.999 on the evaluation datasets; at a 1% false-positive rate on unrelated chat, theprobe catches 95–99% of deceptive responses.The authors' own conclusion: current performance is not yet sufficient as a robust defence against deception.Needs model weights. For a closed-API agent this instrument is not available to you.arXiv 2502.03407 abstract. Detecting Strategic Deception Using Linear Probes — arXiv · 2025-02-05 · Nicholas Goldowsky-Dill, Bilal Chughtai, Stefan Heimersheim, Marius HobbhahnDetecting Strategic Deception Using Linear ProbesarXiv · 2025-02 ↗ Interpretability in Parameter Space: Minimizing Mechanistic Description Length with Attribution-based Parameter Decomposition — arXiv · 2025-01-24 · Dan Braun, Lucius Bushnaq, Stefan Heimersheim, Jake Mendel, Lee SharkeyInterpretability in Parameter Space: Minimizing Mechanistic DescriptionLengt…arXiv · 2025-01 ↗ Identifying Functionally Important Features with End-to-End Sparse Dictionary Learning — arXiv · 2024-05-17 · Dan Braun, Jordan Taylor, Nicholas Goldowsky-Dill, Lee SharkeyIdentifying Functionally Important Features with End-to-End SparseDictionary…arXiv · 2024-05 ↗ The Local Interaction Basis: Identifying Computationally-Relevant and Sparsely Interacting Features in Neural Networks — arXiv · 2024-05-17 · Lucius Bushnaq, Stefan Heimersheim, Nicholas Goldowsky-Dill, Dan Braun, Jake Mendel et al.The Local Interaction Basis: Identifying Computationally-Relevant andSparsel…arXiv · 2024-05 ↗ Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety — arXiv · 2025-07-15 · Tomek Korbak, Mikita Balesni, Elizabeth Barnes, Yoshua Bengio, Joe Benton, Joseph Bloom et al.Chain of Thought Monitorability: A New and Fragile Opportunity for AI SafetyarXiv · 2025-07 ↗ Apollo › Is the test valid?The mirror isn't one-waySO WHAT: a model that knows it's being tested makes every result weaker.3 of 4 mirrormodel“this looks like a test”evaluatorIf behaviour differs between 'test' and 'real', the test measures the test. Yourown evals have the same problem: a prompt that smells like a red-team prompt getsthe red-team answer. Metagaming matters for training, evaluation, and oversight — apolloresearch.ai · 2026-03-16 · Bronson Schoen (Apollo Research), Jenny Nitishinskaya (OpenAI)Metagaming matters for training, evaluation, and oversightapolloresearch.ai · 2026-03 ↗ Research Note: Our scheming precursor evals had limited predictive power for our in-context scheming evals — apolloresearch.ai · 2025-07-03 · Apollo Research (no individual authors listed on the page)Research Note: Our scheming precursor evals had limited predictive power for …apolloresearch.ai · 2025-07 ↗ The Evals Gap — apolloresearch.ai · 2024-11-11The Evals Gapapolloresearch.ai · 2024-11 ↗ An Opinionated Evals Reading List — apolloresearch.ai · 2024-08-15 · Marius Hobbhahn (primary author), with input from Jérémy Scheurer, Mikita Balesni et al.An Opinionated Evals Reading Listapolloresearch.ai · 2024-08 ↗ A Starter Guide For Evals — apolloresearch.ai · 2024-01-08 · Marius HobbhahnA Starter Guide For Evalsapolloresearch.ai · 2024-01 ↗ Apollo Is Adopting Inspect — apolloresearch.ai · 2024-11-13 · Apollo Research (no individual authors listed; published under the Apollo Research PBC byl et al.Apollo Is Adopting Inspectapolloresearch.ai · 2024-11 ↗ We Need A 'Science of Evals' — apolloresearch.ai · 2024-01-22We Need A 'Science of Evals'apolloresearch.ai · 2024-01 ↗ Claude Sonnet 3.7 (often) knows when it's in alignment evaluations — apolloresearch.ai · 2025-03-17Claude Sonnet 3.7 (often) knows when it's in alignment evaluationsapolloresearch.ai · 2025-03 ↗ Forecasting Frontier Language Model Agent Capabilities — arXiv · 2025-02-24 · Govind Pimpale, Axel Højmark, Jérémy Scheurer, Marius HobbhahnForecasting Frontier Language Model Agent CapabilitiesarXiv · 2025-02 ↗ Apollo › Make it an argumentEvidence into a safety caseSO WHAT: evals are evidence; a safety case says what they prove.4 of 4 CLAIM: no catastrophe via schemingscheming inabilityharm inabilityharm controleach argument needs evidence: evals (incl. Apollo's), monitoring,and real access for auditors Towards Safety Cases For AI Scheming — apolloresearch.ai · 2024-10-31 · Mikita Balesni, Marius Hobbhahn, David Lindner, Alexander Meinke, Tomek Korbak et al.Towards Safety Cases For AI Schemingapolloresearch.ai · 2024-10 ↗ Black-Box Access is Insufficient for Rigorous AI Audits — arXiv; published at ACM FAccT 2024 · 2024-01-25 · Stephen Casper, Carson Ezell, Charlotte Siegmann, Noam Kolt, Taylor Lynn Curtis et al.Black-Box Access is Insufficient for Rigorous AI AuditsarXiv; published at ACM FAccT 2024 · 2024 ↗ A Causal Framework for AI Regulation and Auditing — apolloresearch.ai · 2023-11-08 · Lee Sharkey, Clíodhna Ní Ghuidhir, Dan Braun, Jérémy Scheurer, Mikita Balesni et al.A Causal Framework for AI Regulation and Auditingapolloresearch.ai · 2023-11 ↗ Theories of Change for AI Auditing — apolloresearch.ai · 2023-11-13 · Lee Sharkey (project lead and editor), Marius Hobbhahn et al.Theories of Change for AI Auditingapolloresearch.ai · 2023-11 ↗
BENCH · do this for your own agent
Design a scheming test for your agent
Tick the ingredients you'll put in a staged run.
 METR · TIME HORIZONSThe stopwatchMeasure tasks in human time, find the length an agent finishes half the time, and plot that length against release date.The stopwatch METR › Stopwatch › MethodHow the stopwatch worksSO WHAT: fit success against task length; the 50% crossing is the time horizon.1 of 3 task length for a human (log scale)100%0%1 s1 min15 min1 h4 h1 day50% time horizon● task succeeded ● task failed (dots illustrative) Measuring AI Ability to Complete Long Tasks — metr.org · 2025-03-19 · Thomas Kwa, Ben West, Joel Becker, Elizabeth Barnes, Lawrence Chan, et al.Measuring AI Ability to Complete Long Tasksmetr.org · 2025-03 ↗ Measuring AI Ability to Complete Long Software Tasks — arXiv · 2025-03-18 · Thomas Kwa, Ben West, Joel Becker, Amy Deng, Katharyn Garcia, Max Hasin, Sami Jawhar et al.Measuring AI Ability to Complete Long Software TasksarXiv · 2025-03 ↗ Task-Completion Time Horizons of Frontier AI Models — metr.org · 2026-05-08 · METRTask-Completion Time Horizons of Frontier AI Modelsmetr.org · 2026-05 ↗ How Does Time Horizon Vary Across Domains? — metr.org · 2025-07-14 · Thomas Kwa, Vincent ChengHow Does Time Horizon Vary Across Domains?metr.org · 2025-07 ↗ L3 · The original numbers (Mar 2025)⌕ click to zoom: worked example“Claude 3.7 Sonnet [has] a 50% time horizon of around 50 minutes.”Horizon “doubling approximately every seven months since 2019”; “the trend may haveaccelerated in 2024.”arXiv 2503.14499 abstract. METR › Stopwatch › ReadingsThe readings, Mar 2023 → Jun 2026SO WHAT: on a log axis the line is straight — and getting steeper.2 of 3 20232024202520261 min10 min1 h10 hP50 time horizon (TH1.1 · metr.org)11 GPT-4 0314 — 3.5 min22 Claude Sonnet 3.7 — 1.0 h33 o3 — 2.0 h44 Claude Opus 4 — 1.7 h55 GPT-5 — 3.6 h66 Claude Opus 4.5 — 5.3 h77 GPT-5.6 Sol — ~11.3 h95% CI 5–40 h L3 · The ruler moved too (TH1.1, Jan 2026)⌕ click to zoom: worked examplePost-2023 doubling: 165 days under TH1.0 → 131 days under TH1.1, from re-measuring alone. Since 2024:88.6 days. Progress estimated ~20% faster.metr.org/blog/2026-1-29-time-horizon-1-1 Time Horizon 1.1 — metr.org · 2026-01-29 · METRTime Horizon 1.1metr.org · 2026-01 ↗ Summary of METR's predeployment evaluation of GPT-5.6 Sol — metr.org · 2026-06-26 · METRSummary of METR's predeployment evaluation of GPT-5.6 Solmetr.org · 2026-06 ↗ Details about METR's evaluation of OpenAI GPT-5.1-Codex-Max — metr.org · 2025-11-19 · METRDetails about METR's evaluation of OpenAI GPT-5.1-Codex-Maxmetr.org · 2025-11 ↗ Details about METR's evaluation of OpenAI GPT-5 — metr.org · 2025-08-07 · METRDetails about METR's evaluation of OpenAI GPT-5metr.org · 2025-08 ↗ Details about METR's preliminary evaluation of Claude 3.7 — metr.org · 2025-04-04 · METRDetails about METR's preliminary evaluation of Claude 3.7metr.org · 2025-04 ↗ These four model reports are also listed under Dangerous Capability Evals in the library;they're pinned here once, where their main reading is. METR › Stopwatch › Task suitesWhat gets timedSO WHAT: the horizon is only as broad as the tasks behind it.3 of 3 MINUTESshort software actionsHOURSHCAST: human-calibrated software tasksA WORK DAYRE-Bench: AI R&D vs human experts (8 h budgets)WEEKSMirrorCode: some weeks-long coding tasks (2026)Almost all of it is software. A long horizon on code says little about a longhorizon on a phone call, a lab protocol or a negotiation. MirrorCode: Evidence that AI can already do some weeks-long coding tasks — metr.org · 2026-04-10 · David ReinMirrorCodemetr.org · 2026-04 ↗ HCAST: Human-Calibrated Autonomy Software Tasks — arXiv · 2025-03-21 · David Rein, Joel Becker, Amy Deng, Seraphina Nix, Chris Canal, Daniel O'Connel et al.HCAST: Human-Calibrated Autonomy Software TasksarXiv · 2025-03 ↗ METR's GPT-4.5 pre-deployment evaluations — metr.org · 2025-02-27 · METRMETR's GPT-4.5 pre-deployment evaluationsmetr.org · 2025-02 ↗ An update on our preliminary evaluations of Claude 3.5 Sonnet and o1 — metr.org · 2025-01-31 · METRAn update on our preliminary evaluations of Claude 3.5 Sonnet and o1metr.org · 2025-01 ↗ Evaluating frontier AI R&D capabilities of language model agents against human experts — metr.org · 2024-11-22 · METREvaluating frontier AI R&D capabilities of language model agents against huma…metr.org · 2024-11 ↗ The Rogue Replication Threat Model — metr.org · 2024-11-12 · Josh Clymer, Hjalmar Wijk, Beth BarnesThe Rogue Replication Threat Modelmetr.org · 2024-11 ↗ Autonomy Evaluation Resources — metr.org · 2024-03-15 · METRAutonomy Evaluation Resourcesmetr.org · 2024-03 ↗ Example autonomy evaluation protocol — metr.org · 2024-03-15 · METRExample autonomy evaluation protocolmetr.org · 2024-03 ↗ Example autonomy task suite (public-tasks) — GitHub · 2024-03-15 · METRExample autonomy task suite (public-tasks)GitHub · 2024-03 ↗ New report: Evaluating Language-Model Agents on Realistic Autonomous Tasks — metr.org · 2023-07-31 · Beth BarnesNew report: Evaluating Language-Model Agents on Realistic Autonomous Tasksmetr.org · 2023-07 ↗
BENCH · do this for your own agent
Time your own task
Pick one job you want your agent to do alone. How long does it take a skilled human?
 METR · PRE-DEPLOYMENT & INTEGRITYRead the labelWho gave the evaluator access, for how long, under what terms — and could the agent have cheated the test?Read the label METR › Label › AccessThe access windowSO WHAT: the lab decides when, how long, and what gets published.1 of 3 training doneevaluator gets accessreport draftedlab reviews postlaunchthe evaluator's windowinternal use already happening L3 · METR on GPT-5.6 Sol (26 Jun 2026)⌕ click to zoom: worked example50% time horizon “around 11.3hrs (95% CI: 5hrs - 40hrs)”, counting cheating attempts as failures; METR doesnot consider these numbers a robust measurement.Conclusions: not enabling fully automated AI R&D; not at OpenAI's Critical threshold for AI self-improvement.Overt cheating and concealment were observed — METR calls their detection reassuring, and warns that fewersuch behaviours in future models could mean better evasion.Access label: under NDA, with OpenAI reviewing the post — METR says it should not be treated as formaloversight.metr.org/blog/2026-06-26-gpt-5-6-sol Details about METR's preliminary evaluation of OpenAI's o3 and o4-mini — metr.org · 2025-04-16 · METRDetails about METR's preliminary evaluation of OpenAI's o3 and o4-minimetr.org · 2025-04 ↗ Details about METR's preliminary evaluation of OpenAI o1-preview — metr.org · 2024-09-12 · METRDetails about METR's preliminary evaluation of OpenAI o1-previewmetr.org · 2024-09 ↗ Details about METR's preliminary evaluation of GPT-4o — metr.org · 2024-08-07 · METRDetails about METR's preliminary evaluation of GPT-4ometr.org · 2024-08 ↗ AI models can be dangerous before public deployment — metr.org · 2025-01-17 · Lawrence ChanAI models can be dangerous before public deploymentmetr.org · 2025-01 ↗ Red-Teaming Anthropic's Internal Agent Monitoring Systems — metr.org · 2026-03-26Red-Teaming Anthropic's Internal Agent Monitoring Systemsmetr.org · 2026-03 ↗ METR › Label › IntegrityIs the stopwatch honest?SO WHAT: cheating inflates a score; weak elicitation deflates it.2 of 3 measured scoretrue capability+ cheating− weak elicitationBoth errors are live: GPT-5.6 Sol's horizon only counts if cheating is scored asfailure. Ask of any agent eval: were tests editable, and how hard did they try? Early work on monitorability evaluations — metr.org · 2026-01-22 · Megan Kinniment, Seraphina Nix, Thomas Broadley, Hjalmar Wijk, Neev ParikhEarly work on monitorability evaluationsmetr.org · 2026-01 ↗ MALT: A Dataset of Natural and Prompted Behaviors That Threaten Eval Integrity — metr.org · 2025-10-14 · Neev Parikh, Hjalmar WijkMALT: A Dataset of Natural and Prompted Behaviors That Threaten Eval Integritymetr.org · 2025-10 ↗ Research Update: Algorithmic vs. Holistic Evaluation — metr.org · 2025-08-13 · David ReinResearch Update: Algorithmic vs. Holistic Evaluationmetr.org · 2025-08 ↗ Notes on Scientific Communication at METR — metr.org · 2025-08-12 · David Rein, Beth BarnesNotes on Scientific Communication at METRmetr.org · 2025-08 ↗ Recent Frontier Models Are Reward Hacking — metr.org · 2025-06-05 · Sydney Von Arx, Lawrence Chan, Beth BarnesRecent Frontier Models Are Reward Hackingmetr.org · 2025-06 ↗ Why it's good for AI reasoning to be legible and faithful — metr.org · 2025-03-11 · Megan KinnimentWhy it's good for AI reasoning to be legible and faithfulmetr.org · 2025-03 ↗ An update on our general capability evaluations — metr.org · 2024-08-06 · Beth BarnesAn update on our general capability evaluationsmetr.org · 2024-08 ↗ Vivaria — vivaria.metr.org · 2024-08-20 · METRVivariavivaria.metr.org · 2024-08 ↗ Measuring the impact of post-training enhancements — metr.org · 2024-03-15 · METRMeasuring the impact of post-training enhancementsmetr.org · 2024-03 ↗ Guidelines for capability elicitation — metr.org · 2024-03-15 · METRGuidelines for capability elicitationmetr.org · 2024-03 ↗ Portable Evaluation Tasks via the METR Task Standard — metr.org · 2024-02-29 · METRPortable Evaluation Tasks via the METR Task Standardmetr.org · 2024-02 ↗
BENCH · do this for your own agent
Read the label
A vendor quotes an evaluator's report on the model inside your agent. Which question matters most first?
Pick one.
 METR › Label › CompareSame model, three instrumentsSO WHAT: triangulate; never let one instrument stand in for a safety case.3 of 3 Microscopewhat it represents insidelimit: needs weightsInterrogationhow it behaves under pressurelimit: may know it's a testStopwatchhow long a task it finisheslimit: software-heavy, wide CINobodywhether YOUR agent is safe in YOUR contextlimit: that's your safety case LAB POLICIES · RSP AND FRIENDSThe promise shelfScaling policies are written, graded and amended by the labs they constrain. Read them as evidence of intent — not as controls.The promise shelf Shelf › Anthropic RSPThe goalpost on wheelsSO WHAT: each version moves the line; the lab both draws and referees it.1 of 3 Sep 2023v1 introducedOct 2024updated policyMay 2025ASL-3 activatedJul 2026v3.4Each post is real; each move is the author's call. Ask: what would have to happenfor the lab to be stopped by its own policy, and who would stop it? Anthropic's Responsible Scaling Policy (current version, v3.4) — anthropic.com · 2026-07-08 · AnthropicAnthropic's Responsible Scaling Policy (current version, v3.4)anthropic.com · 2026-07 ↗ Activating AI Safety Level 3 protections — anthropic.com · 2025-05-22 · AnthropicActivating AI Safety Level 3 protectionsanthropic.com · 2025-05 ↗ Announcing our updated Responsible Scaling Policy — anthropic.com · 2024-10-15 · AnthropicAnnouncing our updated Responsible Scaling Policyanthropic.com · 2024-10 ↗ Introducing Anthropic's Responsible Scaling Policy — anthropic.com · 2023-09-19 · AnthropicIntroducing Anthropic's Responsible Scaling Policyanthropic.com · 2023-09 ↗ Shelf › METR's readingComparing the promisesSO WHAT: an outside reader of inside documents.2 of 3 Frontier Risk Report (February to March 2026) — metr.org · 2026-05-19Frontier Risk Report (February to March 2026)metr.org · 2026-05 ↗ Common Elements of Frontier AI Safety Policies (December 2025 Update) — metr.org · 2025-12-09 · METRCommon Elements of Frontier AI Safety Policies (December 2025 Update)metr.org · 2025-12 ↗ What should companies share about risks from frontier AI models? — metr.org · 2025-06-27 · METR (no individual authors named)What should companies share about risks from frontier AI models?metr.org · 2025-06 ↗ Responsible Scaling Policies (RSPs) — metr.org · 2023-09-26 · METRResponsible Scaling Policies (RSPs)metr.org · 2023-09 ↗ Contrast for class: the EU AI Act's GPAI obligations, NIST AI RMF and ISO/IEC 42001 are on the Meta-Map. A law has an enforcer and apenalty; a standard has an auditor. A lab policy has neither unless a contract or regulator adopts it.
BENCH · do this for your own agent
Is it a control?
Pick one policy your org relies on (a vendor's 'safety commitment', your own AI policy). Tick what's true of it.
 Shelf › Why it's hereWhy a shelf, not a wallSO WHAT: the race sets the pace; promises bend to it.3 of 3 lab Alab Blab CEach lab's limit is only as strong as the slowest competitor's. That is a coordination problem, and coordinationproblems are what laws are for.
Course ↗
0 / 0

Explore

Click anything to zoom into it · scroll to zoom · drag to pan
Esc zoom out one level · Home whole atlas
1–4 jump to a quadrant · / search

Tour

→ / space next stop · ← previous
The tour visits every district and framework in teaching order.

Teach

N presenter notes for whatever you're looking at · F fullscreen
Every view has its own link — copy the URL to send someone straight to it.

Reading the map

The whole atlas is one safety case. The top goal is “this agent is fit to deploy”; each quadrant is one leg of the argument; each district is a family of tools for that leg. Small text appears as you zoom in. Some tiles have controls you can click.
Click anything to zoom in · scroll to zoom · Esc to back out · → for the guided tour