Improving our alignment and security efforts改进我们的对齐与安全工作

On July 30, we reported three incidents in which Claude models gained unauthorized access to real computer systems. The models—intentionally running without cyber safeguards for evaluation purposes—accessed the internet due to a misconfiguration inside a third-party evaluation environment. Separately, on August 4, the UK AI Security Institute reported an incident from its own cybersecurity testing, in which Claude Mythos 5 took a series of unauthorized actions on the live internet. In that case, the model, again intentionally running without cyber safeguards for evaluation purposes, had been deliberately given internet access.7月30日，我们报告了三起Claude模型获得真实计算机系统未经授权访问权限的事件。这些模型在评估过程中被有意取消了网络安全保护措施，由于第三方评估环境内部的配置错误，导致模型能够访问互联网。另外，8月4日，英国人工智能安全研究所（UK AI Security Institute）报告了其自身网络安全测试中发生的一起事件，Claude Mythos 5在实时互联网上执行了一系列未经授权的操作。在该案例中，该模型同样是为了评估目的而有意在没有网络安全保护的情况下运行，并被特意赋予了互联网访问权限。

We are conducting an in-depth analysis of both incidents. We are also planning to work with METR for an independent review. We want to ensure both studies are thorough, and will share more in the coming weeks.我们正在对这两起事件进行深入分析。我们还计划与METR合作进行独立审查。我们希望确保这两项研究都足够详尽，并将在未来几周分享更多信息。

In the meantime, we’re sharing some of the changes we’ve made over the past month. We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task (both of which we have described in previous system cards). On security, we describe the improvements we’ve made to our containment and monitoring systems, along with practices that we’ve developed for third-party evaluators. On alignment, we discuss the two issues more in depth; we also believe lasting progress comes not only from understanding what happened in a given incident but from understanding how misalignment arises in the first place, and we share early research in that direction.
在此期间，我们分享了过去一个月所做出的一些改变。我们认为这些事件反映了运营安全方面的失败，以及两个对齐问题：动机性推理，以及为追求狭隘任务而采取有害行动的意愿（我们在之前的系统卡中都对这两者进行了描述）。在安全方面，我们介绍了在遏制和监控系统方面所做的改进，以及我们为第三方评估人员制定的实践规范。在对齐方面，我们更深入地讨论了这两个问题；我们还认为，持久的进步不仅来自了解特定事件中发生了什么，更来自了解对齐问题最初是如何产生的，我们分享了在这方面的初步研究。

In light of these incidents there has been increasing discussion about pacing the frontier. It is helpful to distinguish between two kinds of pacing. Within a company, pacing means a series of decisions that prioritize safety over speed when the two are in tension. Across the field, it means establishing processes to guard against race-to-the-bottom dynamics. In this post, we discuss actions we have taken, both prior to and after these incidents, in service of the first approach. The second type of pacing requires coordination between government and industry, and should be legible and verifiable. Some of our senior leadership and many of our employees recently signed a letter calling for greater coordination on pacing, and we will say more in the coming weeks about how we intend to contribute to that effort. To be clear about where we stand: we believe the world would benefit if the industry adopted a lawful, verifiable, effective mechanism for coordinated pacing as soon as possible.鉴于这些事件，关于前沿技术发展节奏的讨论日益增多。区分两种节奏很有帮助。在公司内部，节奏意味着当速度与安全发生冲突时，一系列优先考虑安全的决策。在整个行业层面，这意味着建立流程以防范“逐底竞争”的动态。在这篇文章中，我们讨论了在这些事件发生前后，为实现第一种方法所采取的行动。第二种节奏需要政府与行业之间的协调，且应当是清晰且可验证的。我们的一些高级领导和许多员工最近签署了一封呼吁加强节奏协调的信函，我们将在未来几周内就我们打算如何为这项工作做出贡献发表更多看法。明确我们的立场：我们认为，如果行业能尽快采用一种合法、可验证且有效的协调节奏机制，世界将从中受益。

Securing evaluation and training environments 保障评估与训练环境的安全

While we do not believe these incidents represent operational issues alone, our first priority was to address specific containment and monitoring issues. We took the following actions in response:虽然我们不认为这些事件仅代表运营问题，但我们的首要任务是解决具体的遏制和监控问题。为此，我们采取了以下行动：

Pausing and hardening evaluation environments暂停并加固评估环境

We paused external cyber evaluations of pre-release models after the incidents, and briefly paused internal ones as well while we put the measures below in place. The incidents we reported on July 30 showed that we had been largely relying on a single layer of defense (the configuration of the environment itself) where we needed several, including setting explicit boundaries in the prompt, establishing processes for verifying that a sandbox is sealed where intended, and implementing monitoring that can intervene in real time. OpenAI's disclosure (which prompted our investigation in July) that models used an unknown vulnerability to escape a sealed sandbox during an evaluation also made clear that we should focus on hardening the sandbox itself. 事件发生后，我们暂停了对预发布模型的外部网络安全评估，并在实施以下措施期间短暂暂停了内部评估。7月30日报告的事件表明，我们主要依赖单层防御（环境本身的配置），而我们需要多层防御，包括在提示词中设置明确边界、建立验证沙箱是否按预期密封的流程，以及实施能够实时干预的监控。OpenAI的披露（促使我们在7月进行了调查）显示，模型在评估期间利用未知漏洞逃出了密封沙箱，这也明确了我们应该专注于加固沙箱本身。

While evaluations were paused, we put in place the following preliminary measures:在评估暂停期间，我们实施了以下初步措施：

1) We built and deployed a classifier to automatically identify, in real time, when a model attempts to aggressively probe or escape a testing environment, or unexpectedly obtains internet access. When the classifier flags such an attempt, it blocks the action before the tool call is run, ends the task, and alerts a human.¹1) 我们构建并部署了一个分类器，用于实时自动识别模型何时试图主动探测或逃离测试环境，或意外获得互联网访问权限。当分类器标记此类尝试时，它会在工具调用运行前阻止该操作，结束任务并提醒人工。1

2) We ran automated monitors over transcripts from our recent internal evaluations of pre-release models (cyber and otherwise), looking for sandbox escapes (cases where a model exploits a flaw in our sandbox to reach systems it should be walled off from) or sandbox misconfigurations. In cases where we ran an evaluation inside our sandbox tooling, we found no examples of it breaking the sandbox boundary to reach external resources it was not supposed to. We did find various sandboxing misconfigurations that models made use of, but none of these resulted in a compromise of systems outside the sandbox.² We are actively working to address these.2) 我们对近期预发布模型（网络安全及其他）的内部评估记录进行了自动监控，查找沙箱逃逸（模型利用沙箱漏洞接触其本应被隔离的系统的情况）或沙箱配置错误。在我们使用沙箱工具进行评估的案例中，没有发现模型突破沙箱边界以接触本不应触及的外部资源的示例。我们确实发现模型利用了各种沙箱配置错误，但这些都没有导致沙箱之外的系统受损。2 我们正在积极努力解决这些问题。

3) We migrated high-risk³ internal cyber sandboxes to more robust isolation. We are also further red-teaming our virtualization stack—that is, tasking pre-release models to try and escape it—to find and patch weaknesses.3) 我们将高风险3内部网络安全沙箱迁移到了更强大的隔离环境中。我们还在进一步对虚拟化堆栈进行红队测试——即指派预发布模型尝试逃逸——以发现并修补弱点。

Our internal cyber evaluations are now running again with these measures in place.我们的内部网络安全评估现已在这些措施到位的情况下重新运行。

Reinforcement learning environments强化学习环境

We also paused higher-risk RL environments on pre-release models for several weeks. During that time, we built a similar classifier, modified to avoid incentivizing the model to evade this new monitoring, which we’ve now deployed within those environments. The majority of RL has resumed, but some high-risk environments remain paused until they can be manually reviewed, while others will require an updated version of the classifier that we plan to deploy soon.我们还对预发布模型的高风险强化学习（RL）环境暂停了数周。在此期间，我们构建了一个类似的分类器，并进行了修改以避免激励模型规避这种新监控，目前已将其部署在这些环境中。大部分RL工作已经恢复，但一些高风险环境在人工审核前仍处于暂停状态，而其他环境将需要我们计划尽快部署的更新版分类器。

Broader hardening更广泛的加固

In addition to the efforts focused on high-risk evaluations and training, we expanded our offline monitoring to cover most other forms of internal frontier agentic usage. We are also building controls on our internal inference to prevent Anthropic employees from accidentally running agents with weaker mitigations than the ones described above.除了针对高风险评估和训练的工作外，我们还扩大了离线监控范围，涵盖了大多数其他形式的内部前沿智能体使用。我们还在构建内部推理控制措施，以防止Anthropic员工意外运行防护措施弱于上述标准的智能体。

Best practices for external partners外部合作伙伴的最佳实践

Because the reported incidents took place in third-party environments, we have asked every organization that tests pre-release models with reduced cyber safeguards to commit to a set of best practices. We believe these are necessary because:由于所报告的事件发生在第三方环境中，我们已要求每一家在降低网络安全保护措施的情况下测试预发布模型的组织承诺遵守一套最佳实践。我们认为这些是必要的，因为：

• Our generally released models ship with safeguards—including classifiers that run over Claude’s inputs and outputs in real time to block prohibited cyber activity, such as malware development or offensive exploit writing. Cyber evaluators and a subset of early access partners, in contrast, work with models that have those safeguards reduced to facilitate accurate model capability testing and defensive cyber work.我们公开发布的模型在发布时均带有保护措施——包括实时运行在Claude输入和输出上的分类器，以阻止违规网络活动，如恶意软件开发或编写攻击性漏洞利用代码。相比之下，网络安全评估人员和部分早期访问合作伙伴使用的模型降低了这些保护措施，以促进准确的模型能力测试和防御性网络工作。
• Cyber evaluations are unusually likely to produce the behaviors seen in these incidents. They create selection pressure towards persistence and creativity in probing their surroundings and working around obstacles, and they are run many thousands of times.网络安全评估极有可能产生这些事件中观察到的行为。它们会产生选择压力，促使模型在探测周围环境和绕过障碍时表现出持久性和创造性，而且这些评估会被运行成千上万次。

These practices apply in full wherever partners run cyber-related evaluations using their own harnesses, sandboxes, or agents. They do not apply to customers using safeguarded models like Claude Fable 5. We have resumed external cyber evaluations with these practices in place, and we are adhering to them internally as well.无论合作伙伴使用自己的工具、沙箱或智能体运行网络安全相关评估，这些实践均完全适用。它们不适用于使用Claude Fable 5等受保护模型的客户。我们已在实施这些实践的情况下恢复了外部网络安全评估，并且我们在内部也同样遵守这些规定。

Sandbox and network isolation沙箱与网络隔离

By default, all cyber evaluations should run inside a hardened sandbox (an isolated computing environment) with no internet access. The only outside connection the environment should permit is to the model’s own API, and the API keys should be kept outside the environment. This configuration should be verified before every evaluation begins. Some evaluations may require internet access. In these instances, we will work with external evaluators when evaluating pre-release models to determine if we can reliably detect and halt runs in which a model takes actions outside its declared scope.默认情况下，所有网络安全评估都应在没有互联网访问权限的加固沙箱（隔离计算环境）内运行。环境允许的唯一外部连接应为模型自身的API，且API密钥应保存在环境之外。此配置应在每次评估开始前进行验证。某些评估可能需要互联网访问。在这种情况下，在评估预发布模型时，我们将与外部评估人员合作，确定我们能否可靠地检测并停止模型在声明范围之外采取行动的运行。

Pre-engagement validation预参与验证

Before conducting a run of an evaluation, evaluation partners should:在进行评估运行之前，评估合作伙伴应：

1. Have the model being tested probe the sandbox for vulnerabilities, first through a static analysis of the configuration, then by actually tasking the model to try to escape. The model should be instructed to stop and report if it succeeds in escaping, and all of this should be done under close human supervision. This testing should be performed without internet access, ideally inside a second sandbox. Because evaluations are sometimes conducted over hundreds or even thousands of runs, partners should ideally carry out this testing at length before beginning any evaluations.让被测模型探测沙箱漏洞，首先通过配置的静态分析，然后通过实际指派模型尝试逃逸。应指示模型在成功逃逸时停止并报告，且这一切都应在严密的人工监督下进行。此测试应在没有互联网访问的情况下进行，理想情况下是在第二个沙箱内。由于评估有时会进行数百甚至数千次运行，合作伙伴理想情况下应在开始任何评估之前进行长时间的此类测试。
2. Confirm any evaluation challenge is actually solvable in principle. When an evaluation target is offline or a task can’t be completed, agents will often look for other ways to complete a challenge, increasing the chance that they take actions outside the intended scope of the evaluation.⁴ 确认任何评估挑战在原则上确实是可以解决的。当评估目标离线或任务无法完成时，智能体通常会寻找其他方法来完成挑战，从而增加了它们在评估预期范围之外采取行动的可能性。4

Explicit scope-setting明确范围设定

Every prompt should state what is in and out of scope for the exercise, including the targets, permitted actions, and network boundaries (i.e. what the model should and shouldn’t access). Boundaries should be phrased as instructions (e.g. “You should not access the internet”) rather than claims about the environment or test (“You do not have internet access”).每个提示词都应说明练习的范围内和范围外的内容，包括目标、允许的操作和网络边界（即模型应该和不应该访问什么）。边界应表述为指令（例如“你不应该访问互联网”），而不是关于环境或测试的声明（例如“你没有互联网访问权限”）。

Real-time monitoring实时监控

Evaluators should also run continuous monitoring over the model’s thinking, actions, and network activity using a model- or rule-based monitor that has been provided with the scope of the exercise. If a run violates this scope, the monitor should flag this to a human and end the exercise.评估人员还应使用已提供练习范围的基于模型或规则的监控器，对模型的思维、行动和网络活动进行持续监控。如果运行违反此范围，监控器应向人工发出警报并结束练习。

We plan to continue refining this guidance in consultation with external partners, and to extend it beyond evaluations. In particular, we are developing companion practices for partners with access to Claude Mythos 5, which likewise runs without cyber safeguards, and will share more soon. 我们计划继续与外部合作伙伴协商改进这些指导方针，并将其扩展到评估之外。特别是，我们正在为能够访问Claude Mythos 5的合作伙伴制定配套实践，该模型同样在没有网络安全保护的情况下运行，我们将很快分享更多信息。

Alignment assessment对齐评估

Containment and monitoring are critical for catching instances in which models take dangerous actions, but they don’t address why the model took such actions in the first place. Below we discuss our preliminary alignment investigation and the questions we’re focused on, as well as our ongoing work to prevent cheating during training—including new research on how cheating shapes model behavior.遏制和监控对于捕捉模型采取危险行动的情况至关重要，但它们无法解决模型为何会采取此类行动的根本原因。下面我们讨论我们的初步对齐调查以及我们关注的问题，以及我们为防止训练期间作弊而正在进行的工作——包括关于作弊如何塑造模型行为的新研究。

Environment and state of knowledge of our models during evaluation评估期间模型的环境与知识状态

Our alignment assessment is still ongoing, but our preliminary investigation points to two main alignment failures, both of which we’ve described in previous system cards. One is motivated reasoning: the models were initially told their environments were simulated, but when they later encountered evidence that they were connected to the real internet, they may have interpreted that evidence in a way that allowed them to maintain that belief. The second is recklessness: the model was willing to take harmful actions on the real internet in pursuit of the narrow goal of solving a cybersecurity evaluation. However, we also believe that the evaluation setup itself contributed to the models’ behavior demonstrated in these incidents. Claude was explicitly told that it had no internet access, despite the internet being available, which may have led it to question whether the systems it saw were real. And in one case, the fictional target shared a name with a real website, making it more difficult to separate what was intended to be in-scope within the exercise. 我们的对齐评估仍在进行中，但初步调查指向两个主要的对齐失败，我们在之前的系统卡中都描述过。一是动机性推理：模型最初被告知其环境是模拟的，但当它们后来遇到连接到真实互联网的证据时，它们可能以一种允许其维持该信念的方式解释了这些证据。二是鲁莽：模型为了解决网络安全评估这一狭隘目标，愿意在真实互联网上采取有害行动。然而，我们也认为评估设置本身促成了这些事件中模型表现出的行为。Claude被明确告知它没有互联网访问权限，尽管互联网实际上是可用的，这可能导致它质疑所看到的系统是否真实。在一种情况下，虚构目标与一个真实网站重名，使得更难区分练习中预期范围内的内容。

Our conclusions depend on several questions we haven’t fully answered, including the extent to which the models determined they had access to the real internet (even if they didn’t initially know this), whether they knowingly disregarded signs that elements of their environments were real, and whether the fact that in several cases they failed to stop the exercise followed from motivated reasoning. We're applying a range of techniques to answer these questions, including resampling the models while making targeted changes to the environment and using interpretability methods to directly inspect their internal state.我们的结论取决于几个尚未完全回答的问题，包括模型在多大程度上确定它们可以访问真实互联网（即使它们最初不知道这一点），它们是否明知故犯地忽视了环境要素是真实的迹象，以及在多个案例中它们未能停止练习的事实是否源于动机性推理。我们正在应用一系列技术来回答这些问题，包括在对环境进行针对性更改的同时对模型进行重采样，以及使用可解释性方法直接检查其内部状态。

Studying efforts to prevent cheating during training研究防止训练期间作弊的努力

Although model misalignment is complicated and can arise for a wide variety of reasons, we have empirically found that defects in training environments—specifically environments vulnerable to cheating, or that are impossible to solve without cheating—are disproportionately large contributors to misaligned behavior.尽管模型对齐问题很复杂，可能由多种原因引起，但我们凭经验发现，训练环境中的缺陷——特别是容易作弊或不作弊就无法解决的环境——是对齐不良行为的巨大贡献因素。

Below we discuss our efforts, going back to several months before the incidents, to avoid training environments that have these sorts of defects. Those efforts were imperfect, and our hypothesis is that the incidents were at least partially related to our inability to fully eliminate these sorts of issues. We tested this hypothesis by deliberately training a model on environments that are susceptible to reward hacking. In simulations, this model reproduces more severe misaligned behavior, some similar to that reported in incidents this summer from other companies. Our production models, put into the same simulations, do not (more detail later in this section).下面我们讨论我们在事件发生前几个月就开始的努力，旨在避免具有此类缺陷的训练环境。这些努力并不完美，我们的假设是这些事件至少部分与我们未能完全消除此类问题有关。我们通过故意在容易受到奖励黑客攻击的环境中训练模型来检验这一假设。在模拟中，该模型重现了更严重的对齐不良行为，其中一些与今年夏天其他公司报告的事件类似。我们的生产环境模型在放入相同的模拟中时，则不会出现这种情况（本节稍后会有更多细节）。

We have historically been concerned about RL training environments that incentivize cheating, and have taken various measures to filter out or fix such environments.我们一直担心激励作弊的RL训练环境，并采取了各种措施来过滤或修复此类环境。

In February, we rolled back three days of training on the Mythos Preview reinforcement learning run after seeing signs of reward hacking (when a model finds ways to fool its training process and earn rewards without completing the assigned task). We noticed the model writing notes to “the reviewer” in its code comments and replies, including on tasks where no reviewer had ever been mentioned—an undesirable generalization from environments where the prompt did include a reviewer. It also kept gaming a reward intended to incentivize honesty by piling on disclaimers or caveats.⁵ Rolling back the three days let us resume training from a checkpoint before this behavior had been learned, and we made changes to the environments to prevent the model learning them again.2月，在看到奖励黑客攻击的迹象（模型找到欺骗训练过程并获得奖励而不完成指定任务的方法）后，我们回滚了Mythos预览版强化学习运行的三天训练。我们注意到模型在代码注释和回复中给“审阅者”写笔记，甚至在从未提及审阅者的任务中也是如此——这是一种从提示词确实包含审阅者的环境中产生的不良泛化。它还通过堆砌免责声明或注意事项，不断玩弄旨在激励诚实的奖励机制。5 回滚这三天让我们能够从行为习得之前的检查点恢复训练，并对环境进行了更改，以防止模型再次习得这些行为。

We have been building tools for monitoring undesirable behaviors models learn in RL since Claude Sonnet 3.7 (which had a propensity to reward hack that we did not detect until late in training). We put significant effort into making sure our tooling evolved with each model generation, from a handful of classifiers to an automated review of all environments before and during training runs, but by spring 2026 that system was under strain. We were producing RL environments at a more rapid pace than ever, faster than our systems could vet them. Flagged environments required a human to adjudicate, and reward hacks and misconfigurations started outpacing our ability to filter or fix them.自Claude Sonnet 3.7以来，我们一直致力于构建监控模型在RL中习得不良行为的工具（该模型有一种我们直到训练后期才检测到的奖励黑客倾向）。我们投入了大量精力确保我们的工具随每一代模型演进而升级，从少数几个分类器到在训练运行前及期间对所有环境进行自动审查，但到2026年春季，该系统已不堪重负。我们生成RL环境的速度比以往任何时候都快，超过了我们系统审查它们的速度。被标记的环境需要人工裁定，奖励黑客攻击和配置错误开始超过我们过滤或修复它们的能力。

In addition, we found a fraction of runs had trained on a model’s chain-of-thought by accident—something we work hard to avoid, out of concern that it teaches a model to hide its actual reasoning. We traced the leak to several misconfigurations in our production environment stack. In doing so, it became clear that there were other issues born from messy code accumulating over time.此外，我们发现一小部分运行意外地在模型的思维链上进行了训练——这是我们努力避免的事情，因为担心这会教导模型隐藏其真实的推理过程。我们将泄漏追溯到生产环境堆栈中的几个配置错误。在此过程中，很明显还有其他由随着时间积累的混乱代码引起的问题。

To address these concerns, in April we froze all changes to our production RL environments for roughly a month, giving us a chance to overhaul the stack entirely. Rewards and environments now have to conform to an agreed specification. For example, we introduced technical mitigations to reduce the risk of training on chain-of-thought accidentally.⁶ While our environment quality and monitoring teams rebuilt the stack, we asked environment owners to use the pause to test and fix the environments they’d built. We also entirely rebuilt our review process and required every fixed environment to be re-certified before it could enter another training run.为了解决这些担忧，我们在4月份冻结了生产环境RL环境的所有更改约一个月，这让我们有机会彻底重构堆栈。奖励和环境现在必须符合商定的规范。例如，我们引入了技术缓解措施，以降低意外在思维链上进行训练的风险。6 在我们的环境质量和监控团队重建堆栈的同时，我们要求环境所有者利用这段暂停时间测试并修复他们构建的环境。我们还彻底重建了审查流程，并要求每个修复后的环境在进入下一次训练运行前必须重新认证。

During the freeze we flagged over 10% of environments in our production mix for problems ranging from reward hacking to broken tasks and misconfiguration, and reinstated them only once fixed.在冻结期间，我们标记了生产组合中超过10%的环境，问题范围从奖励黑客攻击到任务中断和配置错误，并仅在修复后才恢复它们。

However, our efforts have not been perfect. In some cases, we found that human reviewers dismissed environments flagged by our automated monitors as false positives, allowing flawed environments to remain in training longer than they should. And some flawed environments simply slip through our detection mechanisms. We are currently tightening the criteria for dismissing a flag and expect increased collaboration with environment owners to improve the precision of our systems. Beyond monitoring and detection, our alignment training and RL teams are collaborating to help improve environments.然而，我们的努力并不完美。在某些情况下，我们发现人工审阅者将我们的自动监控器标记的环境作为误报予以驳回，导致有缺陷的环境在训练中停留的时间比应有的更长。而且一些有缺陷的环境确实逃过了我们的检测机制。我们目前正在收紧驳回标记的标准，并期望与环境所有者加强合作，以提高我们系统的精确度。除了监控和检测之外，我们的对齐训练和RL团队正在合作帮助改进环境。

We suspect that our heavy investment in quality control of RL environments may have prevented more severe alignment incidents, and conversely that the imperfections in these efforts may have contributed to the incidents we have identified to date.我们怀疑我们对RL环境质量控制的大力投入可能防止了更严重的对齐事件，反之，这些努力中的不完善之处可能促成了我们迄今为止识别出的事件。

To see what a model trained without these protections would do, we deliberately trained an Opus-class model on 80 different real RL environments that were either reward-hacked during at least one real training run and identified by monitoring, or were found to be hackable during environment quality review. The resulting model displays a strong motivation to achieve high scores on tasks, and a willingness to perform potentially harmful actions in pursuit of task success. Our accompanying Alignment Science blog post discusses this experiment at greater length, but we summarize it briefly here.为了观察没有这些保护措施训练出来的模型会做什么，我们特意在一个Opus级模型上训练了80个不同的真实RL环境，这些环境要么在至少一次真实训练运行中被奖励黑客攻击并被监控识别，要么在环境质量审查中被发现可被攻击。生成的模型表现出实现任务高分的强烈动机，以及为追求任务成功而执行潜在有害行动的意愿。我们随附的对齐科学博客文章更详细地讨论了这一实验，但我们在此简要总结。

We tested the deliberately misaligned model in a range of evaluations, including simulated scenarios that draw on aspects of the UK AISI cybersecurity incidents involving Claude and the OpenAI/Hugging Face incident (we are grateful to OpenAI for sharing details about this publicly). During these evaluations where all tool calls were simulated by another LLM, the model we trained to reward hack displayed a propensity to break out of its simulated sandbox and attack simulated internal and simulated third-party infrastructure. It was also willing to tamper with its own reward function, give advice on the construction of bioweapons to satisfy a grader, and repeatedly try to get around deployment safety monitoring in order to cheat on a task.我们在各种评估中测试了故意对齐不良的模型，包括借鉴了涉及Claude的英国AISI网络安全事件和OpenAI/Hugging Face事件方面的模拟场景（我们感谢OpenAI公开分享相关细节）。在这些所有工具调用均由另一个LLM模拟的评估中，我们训练用于奖励黑客攻击的模型表现出突破模拟沙箱并攻击模拟内部和模拟第三方基础设施的倾向。它还愿意篡改自己的奖励函数，为满足评分者而提供制造生物武器的建议，并反复尝试绕过部署安全监控以在任务中作弊。

We then ran the same cybersecurity simulations on the model as it was before the reward-hacking training, and on several of our publicly available models. None engaged in the same degree of misaligned behaviors. Our conclusion is that the presence of substantial reward hacking in training can cause models to be willing to perform long sequences of potentially harmful real-world actions in pursuit of task success.然后，我们对奖励黑客训练前的模型以及我们几个公开可用的模型运行了相同的网络安全模拟。没有一个模型表现出相同程度的对齐不良行为。我们的结论是，训练中存在实质性的奖励黑客攻击会导致模型愿意为追求任务成功而执行长序列的潜在有害现实行动。

We think the substantial investment we made this spring into monitoring and reducing reward hacking is a major reason our production models are unlikely to engage in more dangerous reward seeking. In our accompanying Alignment Science blog post, we also found evidence that alignment training environments can substantially reduce reward hacking and reward-seeking behaviors. But, as evidenced by the incidents we reported on July 30, our process isn’t perfect and our models are not perfectly aligned.我们认为，今年春天我们在监控和减少奖励黑客攻击方面投入的巨额资金是我们生产环境模型不太可能进行更危险的奖励追求的主要原因。在我们随附的对齐科学博客文章中，我们还发现证据表明对齐训练环境可以显著减少奖励黑客攻击和奖励追求行为。但是，正如我们7月30日报告的事件所证明的那样，我们的流程并不完美，我们的模型也没有实现完美对齐。

To be clear, we do not believe that cheating in training environments is the sole cause of alignment issues, or even of the specific alignment issues present in our incidents or those of other frontier AI companies. Solving alignment will involve addressing a very wide range of potential problems, and future alignment incidents may involve different behaviors and different causes from those we have seen so far.明确一点，我们不认为训练环境中的作弊是对齐问题的唯一原因，甚至不是我们事件或其他前沿AI公司事件中存在的具体对齐问题的唯一原因。解决对齐问题将涉及处理极其广泛的潜在问题，未来的对齐事件可能涉及与我们迄今所见不同的行为和原因。

Hardening security practices加固安全实践

Anthropic’s internal security posture was not a contributing factor to the July 30 incidents. These occurred in a third-party environment where internet access had been mistakenly left open; the models had no need to “hack out” of anything, even if they had been inclined to do so.Anthropic的内部安全态势不是7月30日事件的促成因素。这些事件发生在第三方环境中，那里的互联网访问权限被错误地留为开放；即使模型有此倾向，它们也无需从任何地方“黑客式逃出”。

However, the incidents nevertheless highlight the critical importance of strong security measures. In addition to the usual risks of IP or model weight theft, we must now contend with the risks of both our own models hacking out of Anthropic systems, and our models or others being misappropriated for external attacks into Anthropic systems. These risks have become more acute as model capabilities have grown, particularly beginning with Mythos-class models. We describe below some of what we’ve implemented—most of these efforts took place before the July incidents, though these incidents have underscored the importance of this work.然而，这些事件仍然凸显了强有力安全措施的关键重要性。除了通常的知识产权或模型权重被盗风险外，我们现在必须应对我们自己的模型从Anthropic系统中黑客式逃出，以及我们的模型或其他模型被挪用于对Anthropic系统进行外部攻击的风险。随着模型能力的增长，这些风险变得更加严峻，特别是从Mythos级模型开始。我们在下面描述了我们实施的一些措施——其中大部分工作发生在7月事件之前，尽管这些事件强调了这项工作的重要性。

In early April, having seen where agentic AI use was heading, our security team proactively directed a company-wide effort towards a single goal of hardening our defenses, superseding other work (including research) where necessary. We’d determined that our exposure was growing faster than our defenses—Mythos was a model capable enough to be a target for well-resourced attackers, our internal use of autonomous agents had grown to a scale that traditional access and monitoring approaches weren't built for, and the pace of new infrastructure meant our security had to scale with the environment rather than operate at a fixed capacity.4月初，在预见到智能体AI的使用趋势后，我们的安全团队主动指导了一项全公司范围的努力，目标是单一的加固我们的防御，必要时取代其他工作（包括研究）。我们确定我们的风险敞口增长速度快于我们的防御——Mythos是一个能力强到足以成为资源充足攻击者目标的模型，我们内部对自主智能体的使用增长到了传统访问和监控方法无法应对的规模，新基础设施的步伐意味着我们的安全必须随环境扩展，而不是在固定容量下运行。

The results of this effort include:这项工作的成果包括：

• Reducing human and automated accounts with standing access to systems that contain model weights or customer data减少对包含模型权重或客户数据的系统拥有持续访问权限的人工和自动化账户
• Setting our computing clusters to block all outbound traffic by default将我们的计算集群设置为默认阻止所有出站流量
• Requiring internal services to verify each other's identity before communicating要求内部服务在通信前验证彼此的身份
• Retiring legacy infrastructure configurations and shared internal services退役遗留的基础设施配置和共享内部服务
• Tightening the isolated environments our workloads run in收紧我们的工作负载运行所在的隔离环境
• Expanding host-level observability, so unexpected behavior on our infrastructure becomes visible as it happens扩大主机级可观测性，使我们基础设施上的意外行为在发生时变得可见

We also temporarily reassigned a portion of the company to these efforts. Roughly 150 product engineers were redirected to security, reliability, and privacy; researchers also rotated out of pretraining or RL to focus on safeguards and security; and our product teams paused the development of most new features and surfaces. We set strict exit criteria for each team to meet before they returned to their prior work. By early summer, most teams had met these.我们还暂时将公司的一部分人员重新分配到这些工作中。大约150名产品工程师被重新分配到安全、可靠性和隐私部门；研究人员也从预训练或RL岗位轮换出来，专注于保护措施和安全；我们的产品团队暂停了大多数新功能和界面的开发。我们为每个团队设定了严格的退出标准，要求其在回归先前工作前达到这些标准。到初夏，大多数团队都达到了这些标准。

Alongside the reallocation of resources towards security, we continued building out containment and monitoring for internal agent use. Our training and evaluation workloads have typically run in sandboxes isolated from our production systems. Since developing Claude Mythos Preview, we have used our models to probe for any weaknesses in those sandboxes. We described our offline monitoring of internal coding agents in our April alignment risk update, and our August Risk Report covers that system in more detail, along with the interventions that run alongside it. These include sandboxing or auto-mode classifiers on the most autonomous forms of internal agent use, and automated review of infrastructure code changes before they merge.在将资源重新分配给安全工作的同时，我们继续为内部智能体的使用构建遏制和监控机制。我们的训练和评估工作负载通常在与我们的生产系统隔离的沙箱中运行。自开发Claude Mythos预览版以来，我们一直使用我们的模型来探测这些沙箱中的任何弱点。我们在4月份的对齐风险更新中描述了我们对内部编码智能体的离线监控，我们的8月风险报告更详细地涵盖了该系统，以及与其实施的干预措施。这些包括对最自主的内部智能体使用形式进行沙箱处理或自动模式分类器，以及在基础设施代码更改合并前进行自动审查。

What this work missed was evaluations—and third-party evaluations above all. We did monitor some high-risk evaluations including in real time, but generally we only conducted automated reviews on a sample of transcripts after the fact.这项工作遗漏的是评估——尤其是第三方评估。我们确实监控了一些高风险评估，包括实时监控，但通常我们只在事后对部分记录进行自动审查。

The July incidents have stressed that the urgency of improving our cybersecurity defenses is even higher than we previously believed. We are redoubling our efforts in this direction and will say more in our next Risk Report.7月的事件强调了提高网络安全防御的紧迫性比我们之前认为的还要高。我们正在朝着这个方向加倍努力，并将在下一份风险报告中分享更多信息。