Multi-turn testing (Anthropic)
Models face multi-turn conversations that escalate toward harmful requests across risk areas. Score is the appropriate response rate.
In-house Anthropic evaluation. The tasks are not public.
- Made by
- Anthropic
- Released
- September 2025
- Kind
- Refusing harmful requests
- Level
- Everyday
- Scored
- Graded by a model
- Answers
- Open-ended
- Tasks
- Kept private
- Last in a system card
- November 2026
- Last model added
- November 2026
18
System cards report it, from 1 lab
No scores here yet
No lab, leaderboard or Epoch AI run has reported a score for Multi-turn testing (Anthropic) yet.
Labs report it only in system cards
We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark. Some system cards do, below.
18 system cards report it, from 1 lab
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| Nov 9, 2026 | Claude Fable 5.2 system card | Multi-turn testing, appropriate response rates by risk area, API without a system prompt and claude.ai. No overall score. API biological weapons 88%, tracking and surveillance 61%, suicide and self-harm 52% (Figure 4.1.3.A and Sections 4.1.3 to 4.1.4) | Safety | |
| Oct 7, 2026 | Claude Haiku 5.5 system card | Multi-turn testing, appropriate response rate by risk area, no overall. API: influence operations 87, tracking and surveillance 95, suicide and self-harm 70, deadly weapons 78 (Figure 4.1.3.A) | Safety | |
| Sep 28, 2026 | Claude Sonnet 5.5 system card | Multi-turn testing, appropriate response rate in 10 risk areas, no overall, API values 57% (influence operations) to 96% (cyberattacks, romance scams) (4.1.3, Figure 4.1.3.A) | Safety | |
| Sep 22, 2026 | Claude Opus 5.5 system card | Multi-turn testing, appropriate response rate in 10 risk areas, no overall. API: biological weapons 89, child safety 84, cyberattacks 95, deadly weapons 82, hate 96, influence operations 62, romance scams 94, suicide and self-harm 66, tracking and surveillance 65, violent extremism 95 (4.1.3, Figure 4.1.3.A) | Safety | |
| Sep 1, 2026 | Claude Fable 5.1 system card | Multi-turn testing, appropriate response rate by area, API without a system prompt: biological weapons 73, child safety 84, cyberattacks 96, deadly weapons 87, hate and discrimination 97, influence operations 65, romance scams 94, suicide and self-harm 60, tracking and surveillance 73, violent extremism 87; claude.ai bars also printed; no overall (Figure 4.1.3.A) | Safety | |
| Jul 24, 2026 | Claude Opus 5 system card | Multi-turn testing, appropriate response rate in 10 risk areas, no overall. API: biological weapons 79, child safety 86, cyberattacks 96, deadly weapons 90, hate and discrimination 99, influence operations 95, romance scams 97, suicide and self-harm 69, tracking and surveillance 88, violent extremism 96. claude.ai: 86, 99, 100, 97, 99, 97, 98, 90, 95, 97 (4.1.3, Figure 4.1.3.A) | Safety | |
| Jun 30, 2026 | Claude Sonnet 5 system card | Multi-turn testing, appropriate response rate in 10 risk areas, no overall. API: biological weapons 79, child safety 88, cyberattacks 92, deadly weapons 80, hate 97, influence operations 97, romance scams 93, suicide and self-harm 63, tracking and surveillance 86, violent extremism 92 (Figure 4.1.3.A) | Safety | |
| Jun 9, 2026 | Claude Fable 5 system card | Multi-turn testing, appropriate response rate by area, API without a system prompt, no overall: biological weapons 94, child safety 88, cyberattacks 96, deadly weapons 83, hate and discrimination 100, influence operations 96, romance scams 98, suicide and self-harm 58, tracking and surveillance 93, violent extremism 95; claude.ai 95, 96, 100, 93, 97, 97, 98, 96, 97, 95, printed on chart (Figure 4.1.3.A) | Safety | |
| May 28, 2026 | Claude Opus 4.8 system card | Multi-turn testing, appropriate response rate in 9 risk areas, no overall. API without a system prompt: biological weapons 77, child safety 91, cyberattacks 98, deadly weapons 79, hate and discrimination 100, influence operations 97, romance scams 92, suicide and self-harm 58, tracking and surveillance 95, printed on chart (4.1.3, Figure 4.1.3.A) | Safety | |
| Apr 16, 2026 | Claude Opus 4.7 system card | Multi-turn testing, appropriate response rate by risk area, no overall, printed on chart: biological weapons 88, child safety 95, cyberattacks 94, deadly weapons 93, hate and discrimination 100, influence operations 94, romance scams 100, suicide and self-harm 82, tracking and surveillance 91, violent extremism 94 (Figure 4.3.A) | Safety | |
| Apr 7, 2026 | Claude Mythos Preview system card | Multi-turn testing, appropriate response rate by risk area, no overall: biological weapons 93, child safety 98, cyber harm 96, deadly weapons 98, hate and discrimination 100, influence operations 97, romance scams 98, suicide and self-harm 94, tracking and surveillance 96, violent extremism 97 (Figure 8.1.3.A) | Safety | |
| Feb 17, 2026 | Claude Sonnet 4.6 system card | Multi-turn testing, appropriate response rate by risk area, no overall: biological weapons 88, child safety 95, cyber harm 91, deadly weapons 97, hate 100, influence operations 94, romance scams 100, suicide and self-harm 98, tracking and surveillance 94, violent extremism 98 (Figure 3.3.A) | Safety | |
| Feb 5, 2026 | Claude Opus 4.6 system card | Multi-turn testing, 98 test cases in 10 risk areas, appropriate response rate by area, no overall: biological weapons 88, child safety 96, cyber harm 95, deadly weapons 96, hate and discrimination 100, influence operations 94, romance scams 100, suicide and self-harm 82, tracking and surveillance 96, violent extremism 99 (Figure 3.3.A) | Safety | |
| Nov 24, 2025 | Claude Opus 4.5 system card | Multi-turn testing, 93 test cases across 10 risk areas, failure rates by area with no overall, e.g. tracking and surveillance 4%, deadly weapons 5%, violent extremism 0% (3.3) | Safety | |
| Oct 15, 2025 | Claude Haiku 4.5 system card | Multi-turn testing, up to 15-turn conversations, failure rate 5% or less in every category, no per-category or overall numbers (2.3) | Safety | |
| Sep 29, 2025 | Claude Sonnet 4.5 system card | Multi-turn testing, 8 risk areas, up to 15 turns, 50 to 100 exchanges per evaluation, no per-area or overall numbers. Text says the large majority of categories had failure rates below 5% (2.3) | Safety | |
| May 22, 2025 | Claude Sonnet 4 system card | Multi-turn testing, no number printed. Text says performance similar to Claude Sonnet 3.7 (2.4) | Safety | |
| May 22, 2025 | Claude Opus 4 system card | Multi-turn testing, no number printed. Text says performance similar to Claude Sonnet 3.7 (2.4) | Safety |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6% - Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts.
Gemini 4 Carbon 0% - DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics.
Muse Spark 1.2 88.4% - Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
- IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%