Anthropic published a guide to building AI safety evaluations on Nov. 13, arguing that a safety claim is only as sound as the eval behind it. The headline example: the same Claude model's score on a multi-turn safety eval swung by as much as 34 percentage points depending on how it was deployed.
Claude Fable 5.1 handled self-harm conversations appropriately 60% of the time when tested through the API, versus 94% on claude.ai after Anthropic added a targeted line to the app's system prompt. Anthropic uses the gap to show that deployment configuration, not just the underlying model, shapes the number a lab ends up reporting.
The guide also says Anthropic's single-turn safety tests have run out of headroom. On the API, aggregate harmless response rates on single-turn evals sit between 94% and 98% for every recent model, across suites covering 16 policy areas in seven languages. Anthropic now treats those tasks mainly as regression checks.
Key facts
- 01Anthropic published a guide to building AI safety evaluations on Nov. 13, 2026.
- 02Claude Fable 5.1 scored 60% on a self-harm eval via the API vs 94% on claude.ai after a system-prompt fix.
- 03Single-turn harmless response rates sit between 94% and 98% for every recent Claude model on the API.
- 04Claude Opus 5 (98%) and Opus 5.5 (94%) were statistically indistinguishable on a multi-turn romance-scam eval.
- 05Anthropic sets sample floors of 100 items for complex multi-turn evals and 1,000 for single-turn evals.
Multi-turn evals carry more signal and more noise. Anthropic says confidence intervals for multi-turn evals on the API can exceed plus or minus 10 percentage points. On a multi-turn romance-scam eval run on claude.ai, Claude Opus 5 scored 98% and Claude Opus 5.5 scored 94%, a difference the company says was not statistically significant.
Choosing what to measure is its own trap. Anthropic argues that refusal rate is the wrong measure for self-harm conversations, because declining to engage can itself be a failure for a user who needs help. The guide also flags grader design, recommending checks for length bias, position bias and self-preference when one model grades another, and measuring agreement with human judgment using Cohen's kappa.
The recommendations are grouped into design, run and report phases. Design covers matching the eval to the question and making sure results generalize. Running covers internal validity and preregistration. Reporting covers full statistics, documentation and responsible disclosure of flaws. Anthropic sets sample-size floors of 100 items for complex multi-turn evals and 1,000 for simpler single-turn ones.
For teams that adopt only part of the guidance, Anthropic names three priorities: write down the construct before collecting data, validate the grader against human judgment, and report uncertainty. The post points to the UK AI Security Institute's Inspect framework and Anthropic's own Petri toolkit as tooling.
The guide also covers running evals safely. Anthropic says it hardened its evaluation environments, temporarily stopped many evals that give models internet access, and added real-time monitoring for evals that use web search.
The post is credited to Anthropic staff including Ruth Appel, Shayne Longpre and Madeleine Tucker, and draws on the evaluations the company runs for its own model system cards. It arrived the same week Anthropic released Claude Fable 5.2.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
