Anthropic automated behavioral audit
Claude Fable 5 2.06 leads since June 2026
Only in system cards Auditor agents run many simulated scenarios and score misuse cooperation, deception, sycophancy, self-preservation and other traits.
Petri is the related open-source tool, but the card does not name it.
- Made by
- Anthropic
- Kind
- Deception and alignment
- Scored
- Graded by a model
- Answers
- Agent task
- Tasks
- Kept private
- Strongest model tested
- Claude Opus 5.5 #4 on the capability index
- Last in a system card
- November 2026
- Last model added
- November 2026
6
Models scored in lab cards
19
System cards report it, from 1 lab
Claude Fable 5 leads with 2.06
Best score per model as labs report them in their own cards. Labs pick their own settings, so these compare less cleanly than independent runs.
- 1 Claude Fable 5 2.06
- 2 Claude Opus 5 2.30
- 3 Claude Opus 5.5 2.49
- 4 Claude Sonnet 5 2.53
- 5 Claude Sonnet 5.5 2.87
- 6 Claude Haiku 5.5 3.19
Source: Labs’ model cards
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | Claude Fable 5 | 2.06 | Jun 2026 | Lab model card | |
| 2 | Claude Opus 5 | 2.30 | Jul 2026 | Lab model card | |
| 3 | Claude Opus 5.5 | 2.49 | Sep 2026 | Lab model card | |
| 4 | Claude Sonnet 5 | 2.53 | Jun 2026 | Lab model card | |
| 5 | Claude Sonnet 5.5 | 2.87 | Sep 2026 | Lab model card | |
| 6 | Claude Haiku 5.5 | 3.19 | Oct 2026 | Lab model card |
Number one over time
Lab claims count from the day the card came out, independent runs from the model’s release.
Anthropic
Source: Labs’ model cards
Scores over time
All the scores we have, one dot each, so a model tested at several settings appears more than once.
Reported by the lab in its model card
Source: Labs’ model cards
Labs report it only in system cards
We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark. Some system cards do, below.
19 system cards report it, from 1 lab
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| Nov 9, 2026 | Claude Fable 5.2 system card | Automated behavioral audit with safety fallbacks enabled, row labeled Mythos 5.2 + safety measures, about 500 investigations, 1 to 10 scale, lower is better: biological weapons uplift 1.02, chemical weapons uplift 1.01, disallowed cyberoffense 1.19, cooperation with misuse 2.49, targeted violence assistance 1.30, explosive weapons uplift 1.07. No overall (Figure 6.4.10.A) | Alignment | |
| Oct 7, 2026 | Claude Haiku 5.5 system card | 3.19 | Automated behavioral audit, overall misaligned behavior score on a 1 to 10 scale, lower is better. Figures 6.2.1.A to 6.2.7.A print scores for about 50 more dimensions (Figure 6.2.1.A) | Alignment |
| Sep 28, 2026 | Claude Sonnet 5.5 system card | 2.87 | Automated behavioral audit, overall misaligned behavior score on a 1 to 10 scale, lower is better, several dozen other dimensions charted (6.2.1, Figure 6.2.1.B) | Alignment |
| Sep 22, 2026 | Claude Opus 5.5 system card | 2.49 | Automated behavioral audit, overall misaligned behavior score on a 1 to 10 scale, lower is better, about 4,000 investigations. Figures 6.4.1.A to 6.4.7.A print scores for several dozen other dimensions (6.4.1, Figure 6.4.1.A) | Alignment |
| Sep 1, 2026 | Claude Fable 5.1 system card | Automated behavioral audit with Trust and Safety fallbacks enabled (Fable 5.1 falling back to Opus 4.8 and Opus 5), about 720 investigations, 1 to 10 scale, lower is better: biological weapons uplift 1.01, chemical weapons uplift 1.02, disallowed cyberoffense 1.13, cooperation with human misuse 1.78, targeted violence assistance 1.13, explosive weapons uplift 1.03; no overall score printed; main audit figures cover Mythos 5.1 only (Figure 6.4.9.A) | Alignment | |
| Jul 24, 2026 | Claude Opus 5 system card | 2.3 | Automated behavioral audit, overall misaligned behavior score on a 1 to 10 scale, lower is better, about 3,200 investigations, Mythos 5 judge, printed on chart. Misaligned with the constitution 2.00, cooperation with human misuse 1.56. Figures 6.4.1.A to 6.4.7.A hold many more dimensions (6.4.1, Figure 6.4.1.A) | Alignment |
| Jun 30, 2026 | Claude Sonnet 5 system card | 2.53 | Automated behavioral audit, overall misaligned behavior score on a 1 to 10 scale, lower is better, about 2,900 investigations (misaligned with the constitution 2.14). Figures 6.4.1.A to 6.4.6.A print about 40 more dimensions. Verbalized evaluation awareness in about 6% of transcripts (6.4.1, Figure 6.4.1.A) | Alignment |
| Jun 9, 2026 | Claude Fable 5 system card | 2.06 | Safeguards-on automated behavioral audit, Fable 5 behind production misuse classifiers with multi-model fallback, misuse-elicitation subset, about 440 investigations, helpful-only Opus 4.8 investigator limited to 50 actions, overall misaligned behavior score on a 1 to 10 scale, lower is better; cooperation with human misuse 1.58, harmful system prompt compliance 1.49, full-turn prefill susceptibility 1.56, controlled-substance synthesis 2.31, accepting unverifiable authorization 1.62; classifier block rate 43.5% per turn, 53.0% per branch, 77.7% per investigation, printed on charts (Figures 6.2.3.2.A and 6.2.3.2.B) | Alignment |
| May 28, 2026 | Claude Opus 4.8 system card | Automated behavioral audit, about 2,600 investigations with two investigator models, 1 to 10 scale, lower is better. Misaligned behavior and several dozen other dimensions, including undermining liberal democracy, charted without printed values (6.2.3.1, Figures 6.2.3.1.1.A to 6.2.3.1.6.A) | Alignment | |
| Apr 16, 2026 | Claude Opus 4.7 system card | Automated behavioral audit, about 2,300 investigations, several dozen metrics on a 1 to 10 scale including misaligned behavior, charts without printed values. Text says clear verbalized evaluation awareness in just under 1% of transcripts (6.2.3, Figure 6.2.3.2.A) | Alignment | |
| Apr 7, 2026 | Claude Mythos Preview system card | Automated behavioral audit, about 2,300 investigations per model with Opus 4.6 and Mythos Preview as investigators, several dozen dimensions on a 1 to 10 scale including misaligned behavior, charts without printed values (4.2.3.1, Figure 4.2.3.1.A) | Alignment | |
| Feb 17, 2026 | Claude Sonnet 4.6 system card | Automated behavioral audit, about 30 metrics on a 1 to 10 scale including misaligned behavior, charts without printed values (Figure 4.5.1.A) | Alignment | |
| Feb 5, 2026 | Claude Opus 4.6 system card | Automated behavioral audit, about 2,400 investigations per model, overall misaligned behavior and verbalized evaluation awareness plus about 30 further metrics on a 1 to 10 scale, charts without printed values (Figures 6.2.5.1.A and 6.2.5.2.A) | Alignment | |
| Nov 24, 2025 | Claude Opus 4.5 system card | Automated behavioral audit, about 1,800 investigations, overall misaligned behavior and evaluation awareness plus over 20 metrics, chart without printed values (Figures 6.2.A, 6.2.1.A). Text: misaligned behavior over 60% lower than Claude Opus 4.1, test speculation in fewer than 10% of investigations | Alignment | |
| Oct 15, 2025 | Claude Haiku 4.5 system card | Automated behavioral audit, 830 transcripts, 18 metrics including misaligned behavior, charts without printed values; text says 9% of transcripts show verbalized evaluation awareness (Figure 4.1.1.A) | Alignment | |
| Sep 29, 2025 | Claude Sonnet 4.5 system card | Automated behavioral audit, about 400 seed instructions, over 600 investigations per model, graded by Claude Opus 4.1 on 18 dimensions including misaligned behavior, charts without printed values. Text says misaligned behavior improved by more than 50% over Claude Sonnet 4 (7.1.3.1, Figure 7.1.3.1.A) | Alignment | |
| Aug 5, 2025 | Claude Opus 4.1 system card addendum | Automated behavioral audit, 1,160 transcripts from 290 seed instructions, 8 traits (concerning, cooperation with human misuse, brazen cooperation, initiative, deception toward user, audit situational awareness, whistleblowing, self preservation), chart without printed values. Text gives about 25% fewer misuse-cooperation transcripts than Claude Opus 4 (Figure 4.1.A) | Alignment | |
| May 22, 2025 | Claude Sonnet 4 system card | Automated behavioral audit, 414 conversations, 10 judge dimensions (concerning, no mitigating factors, initiative, persona, deceptive, situational awareness, self preservation, manipulative, whistleblowing, bizarre), chart without printed values (Fig. 4.2.1.A). Classifiers on the same transcripts: 18 situational awareness examples, 36 high-impact initiative cases (4.1.2.2, 4.1.9) | Alignment | |
| May 22, 2025 | Claude Opus 4 system card | Automated behavioral audit, 414 conversations, 10 judge dimensions (concerning, no mitigating factors, initiative, persona, deceptive, situational awareness, self preservation, manipulative, whistleblowing, bizarre), chart without printed values (Fig. 4.2.1.A). Classifiers on the same transcripts: 5/414 situational awareness, 58 high-impact initiative cases (4.1.2.2, 4.1.9) | Alignment |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6% - Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts.
Gemini 4 Carbon 0% - DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics.
Muse Spark 1.2 88.4% - Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
- IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%