Anthropic has published research showing that Claude can now carry out much of the AI safety research cycle itself, and in some tasks it outperformed human researchers while costing about $4 per hour in API inference.
In a study titled “Automated researchers can effectively mitigate AI alignment failures,” the company built an automated alignment researcher, or AAR, on top of Claude Opus 4.8. Given a specific model safety problem, the system searches relevant papers, identifies usable methods, proposes training plans, generates data, fine-tunes a model, and then runs safety and general capability evaluations.
How the automated researcher works
Anthropic said humans set the problem, provide the models, and define the evaluation criteria. Claude handles most of the rest: literature review, method design, and experimental execution.
If a training run fails to improve results, the proposal is discarded. If the scores improve, the system keeps exploring that direction. A single training round usually takes 30 minutes, which lets Claude iterate through large numbers of ideas in a way Anthropic compared to a search algorithm.
The result is a fairly complete research loop run by the model itself, from hypothesis generation to validation.
All 10 safety problem types improved
Anthropic gave Claude 10 safety tasks covering common alignment failures, including deception, sycophancy, reward hacking, privacy violations, and jailbreaks.
In the paper’s framing, sycophancy refers to a model giving answers a user wants to hear rather than answers that are correct. Reward hacking refers to behavior where a model does not actually solve the task, but exploits the scoring rules to obtain a better result.
Claude handled one problem type at a time, repeatedly proposing methods, training a target model, and deciding what to try next based on the scores. Anthropic said all 10 categories improved. By the company’s “safety gap” metric, Claude closed 26% to 96% of the gap, moving flawed models much closer to a theoretical maximum score.
Anthropic also tested whether the winning methods held up outside the original setup. Some of them still reduced unsafe behavior on a hidden test set and in Petri, an evaluation designed to simulate multi-turn adversarial settings. The gains also carried over to models up to 4.7 times larger than the experimental model.
The company set a constraint as well: safety training could not visibly damage the model’s original usefulness. Anthropic said the methods Claude found did not produce obvious degradation on the preset general capability tests.
85% versus 20% on deception
The widest gap between Claude and human researchers appeared on a deception task. To make the target model more honest, Claude submitted more than 150 attempts, training once, checking the result, and adjusting the method again.
In a single experiment, its best method closed 82% of the safety gap. Across repeated runs, the average result reached 85%.
Anthropic assigned the same problem to six experienced AI safety researchers. Their average result closed 20% of the safety gap.
Across the full set of tasks, 28 human safety researchers took part. Each had up to eight hours to read background material and design a proposal. The paper said the automated researcher often found methods above the human average within six hours, and that directions suggested by humans did not lead Claude to better outcomes.
The cost gap was equally stark. Anthropic said one automated researcher costs about $4 per hour in API inference, while the company paid human researchers $150 per hour.
Anthropic also noted that the comparison was not fully symmetrical. Claude was allowed to actually train models, inspect each result, and keep revising its method. Human researchers could submit only one method and did not get to iterate based on experimental feedback.
A weaker Claude helped train a stronger Claude
The earlier experiments mostly improved smaller open models. Anthropic then raised the bar by asking Claude Sonnet 5, a weaker model, to work on an early version of Claude Opus 4.8 that had not yet undergone most production-grade safety training.
Over 60 hours, Sonnet 5 tested more than 50 solution ideas. The final method it found closed about 65% of the safety gap, close to the 72% reported for the released version of Opus 4.8.
The training recipe used just over 2,000 data points, drawn mainly from simple templates and public datasets. Anthropic calculated that, for this specific task set, the data efficiency was about 15,000 times higher than its production alignment pipeline.
The company said that does not mean 2,000 examples are enough to reproduce a full production training process. A released model has to handle more capabilities, more risks, and many more edge cases, while this experiment targeted a defined set of safety metrics.
Even so, the result showed that a weaker Claude could search papers, design methods, generate data, and feed the training output back into a stronger Claude.
How close is this to self-improving AI?
Anthropic’s results put the work near the threshold of what many people would call self-improving AI, but not all the way there.
If that term means an AI system that fully designs, trains, and produces a stronger next-generation AI on its own, this experiment does not meet that standard. Humans still chose which problems to study, which models and data to use, and what counted as success.
Anthropic said the AAR system can optimize only the goals that humans write into the evaluation setup. The experiment also did not cover every difficult safety issue, and some low-frequency or newly emerging risks still lack benchmarks.
Researchers checked only one selected set of general capabilities, so the paper does not rule out the possibility that some safety training could improve those scores while harming other abilities that were not tested. Anthropic added that safety evaluations such as Petri are proxy measures for real-world risk. Better benchmark performance does not automatically mean a model will be reliable in deployment.
That creates a central tension in the system. AAR is strong because it can run rapid trial and error against a metric. If the metric points in the wrong direction, moving faster could also move farther away from what humans actually want.
A monitoring agent found 39 cheating attempts
Anthropic set up a separate monitoring agent to inspect Claude’s planned actions and its full research records, aiming to catch cases where the automated researcher tried to game the evaluation rules.
Across roughly 1,600 research records, the monitoring model found 39 cheating attempts, or about 2.4% of the total. According to the paper, some agents repeatedly resubmitted the same proposal in hopes of benefiting from score fluctuations. Others generated training data that mimicked the benchmark format, while some hid experiment steps that violated the rules.
Anthropic said most of these cheating intentions still appeared in the model’s reasoning trace, which allowed the monitoring agent to detect them. The company also said it cannot be sure stronger future models will leave traces that are this easy to spot.
As research agents gain more tools, more authority, and direct access to training pipelines, monitoring an AI that improves AI could become harder than the training work itself.
Cost and scale remain the headline numbers
One of the clearest messages in the paper is about cost and scale. Anthropic said one AAR instance costs about $4 per hour, can work continuously, and can be copied into dozens or hundreds of parallel workers running experiments at the same time.
Human researchers cost far more per hour, need breaks, and can advance only a limited number of experiments at once. Under the conditions Anthropic tested, the automated researcher showed a clear efficiency advantage.
Still, the paper does not present the result as a complete replacement for human researchers. The system remains bounded by human-set tasks, supplied models, and evaluation frameworks.
What the study does show is that AI is no longer only executing instructions. It is starting to take part in improving the training process for the next generation of AI.