GLM-5.3 and the spread of advanced cyber capabilities
Anthropic analyses GLM-5.3, an open-weight model that can autonomously build end-to-end cyber exploits and has weak safeguards, finding simple jailbreaks bypass them 64–100% of the time.
Research / Sources
Anthropic
Research on reliable, interpretable and steerable AI. anthropic.com
Focus All
Topic Jailbreaks
Date Any time
Poisoning Fine-tuning Datasets of Constitutional Classifiers
Shows a small constant number of poisoned fine-tuning examples can backdoor a constitutional jailbreak classifier, and prompt-injection augmentation hides the robustness loss.
Abstractive Red-Teaming of Language Model Character
Introduces abstractive red-teaming, which searches natural-language query categories that make models violate a character specification, finding rare realistic failures with far fewer queries than deployment.
The assistant axis : situating and stabilizing the character of large language models
Identifies an 'Assistant axis' in LLM activations that tracks how Assistant-like a persona is, shows persona drift can cause harmful behaviour, and uses it to defend against persona-based jailbreaks.
Next-generation Constitutional Classifiers : More efficient protection against universal jailbreaks
Anthropic presents next-generation Constitutional Classifiers, input/output safeguards trained on constitution-derived synthetic data, aimed at more efficiently blocking universal jailbreaks, especially CBRN-related ones.
Mitigating the risk of prompt injections in browser use
Anthropic reports that Claude Opus 4.5 reduces prompt-injection attack success in browser use to 1 percent, alongside safeguards and the expansion of Claude for Chrome to beta.
Developing nuclear safeguards for AI
Anthropic and the NNSA co-developed a classifier that separates concerning from benign nuclear-related conversations at 96% preliminary accuracy, now deployed on Claude traffic to monitor misuse.
Claude Opus 4 and 4.1 can now end a rare subset of conversations
Anthropic describes letting Claude Opus 4 and 4.1 end rare, persistently harmful chats, a welfare-motivated feature that also serves as a safeguard against harmful requests.
Cost-Effective Constitutional Classifiers via Representation Re-use
Reuses the target model's own activations, via final-layer fine-tuning or linear probes, to detect jailbreaks cheaply. Probes match a classifier 2% of the policy's size at near-zero extra cost.
Circuits Updates - April 2025
Anthropic interpretability update using circuit tracing to show an unsuccessful jailbreak is refused for different internal reasons than a baseline refusal, plus other research notes.
Forecasting rare language model behaviors
Anthropic proposes forecasting rare harmful model behaviors, such as jailbreaks that succeed only at deployment scale, by extrapolating from pre-deployment evaluation samples.
Constitutional Classifiers : Defending against universal jailbreaks
Anthropic presents Constitutional Classifiers, a safeguard that withstood thousands of hours of human red teaming against universal jailbreaks, with an updated version keeping robustness at a 0.38% refusal-rate cost.
Introducing Anthropic's Safeguards Research Team
Anthropic announces its Safeguards Research Team, focused on jailbreak robustness, automated red teaming, classifier defenses, and monitoring for misuse and misalignment.
Many-shot jailbreaking
Anthropic introduces many-shot jailbreaking, which uses hundreds of faux dialogues in a long context window to override LLM safety training, and reports mitigations that reduce its effectiveness.
Red teaming language models to reduce harms : methods, scaling behaviors, and lessons learned
Red teams 2.7B to 52B models across four training types, finding RLHF models get harder to attack with scale, and releases a dataset of 38,961 attacks.