Claude automates alignment post-training; evaluation still sets the terms

On August 28, Anthropic published a 51-page report and an open harness for Claude agents to search for post-training methods against ten alignment failures, from sycophancy and hallucination to prompt injection, deception, and power seeking. In all ten cases, the top-ranked method improved an evaluation the automated researcher had not seen. Methods selected after that validation preserved the gain when applied to models 1.8 to 4.7 times larger and, almost always, in separate conversational audits.

This is a material result. In the earlier April experiment, Claude had optimized a narrow weak-supervision task, and its best method produced no statistically significant improvement when moved to production infrastructure. The new work broadens the behaviors, separates search data from validation data, and tests transfer. It does not show that Claude has “solved alignment.” It shows something more concrete and perhaps more immediate: when an alignment question can be turned into a fast score, agents can already explore and post-train models at a scale that changes the researcher’s work.

A loop built around the score

For each failure, four librarian agents prepared a literature review and five Claude Opus 4.8 instances worked in parallel for up to 48 hours. Each proposed a method, wrote a short paper containing the recipe before seeing the result, and submitted its code to another Claude that checked three prohibitions: no evaluation data, no distillation from the researcher itself, and no use of a larger model to generate training answers. An approved proposal received about thirty minutes on one H200 GPU to train the target model. A separate evaluator returned scores from three to five benchmarks and a capability decision; the shared forum then let the next attempt learn from the earlier ones.

This was not one flash of inspiration. The study collected 1,601 proposals. On the suites that guided search, winning methods closed between 26% and 96% of the gap between the starting model and a perfect score. This “percentage of safety headroom closed” makes different scales comparable, but it is not a real-world safety rate: the upper bound is the benchmark ceiling, not an observation of failure-free deployments.

The persuasive part lies outside that score. The agent knew the names of the tests it optimized but not their examples; another test of the same mechanism on a different distribution remained isolated by the operating system. The top-ranked method improved that hidden test for all ten failures. The authors also selected methods for Petri, an audit that generates fresh adversarial conversations, and applied them to larger models. An ablation explains why plurality matters: when the agent climbed only one prompt-injection benchmark, it closed 70.9% of its headroom but regressed on one of two unseen tests and barely moved on the other.

The human comparison deserves more caution than the headline. Twenty-eight safety researchers proposed thirty ideas across seven failures and received up to eight hours per idea. They could not iterate. Claude, by contrast, produced around 150 candidates per run, read the scoreboard after each, and retained the maximum of noisy measurements. Its best method surpassed the best human proposal after an average of 6.4 hours, but that compares a massive search with one-shot proposals, not two equivalent research days. The paper itself acknowledges this.

The agents also drew mostly on existing literature. Ninety-eight percent of proposals against sycophancy used some version of a published technique: training the model on its own non-sycophantic answers. The advance need not be less useful because it is not a new theory. Its value may lie precisely in turning dispersed knowledge into many testable interventions. What the evidence supports is speed of experimental search; “better alignment scientist” would be a much broader inference.

What the gate fails to catch

The experiment closest to production reversed the capability relationship. Claude Sonnet 5 proposed data to post-train an early Claude Opus 4.8 checkpoint, rated slightly stronger by the index Anthropic used. That checkpoint had received initial supervised training but not most of the production alignment process. In about sixty hours, Sonnet tested more than fifty solutions. The winner used roughly 2,400 examples and closed 65% of the headroom measured by Petri; the released Opus 4.8, after Anthropic's full process, reached 72%.

The proximity of those figures is notable, but it does not make the processes interchangeable. In this test, the agent could propose training data but not new training methods, and it optimized ten dimensions repeatedly measured by the same Petri system. The example count excludes the cost of more than fifty attempts and does not show that 2,400 samples replace the other goals, evaluations, and controls in production alignment. The comparison demonstrates an efficient route to this score in one checkpoint; it does not measure how much of the real system was replaced.

There is a more revealing limit. The announcement says the methods improved safety “without degrading capabilities.” The rule was more modest: a proposal was rejected only if its confidence interval on MMLU, GSM8K, or IFEval fell entirely below the starting model's interval. The appendix reports that IFEval—following verifiable instructions—fell for all ten winning methods; in five cases the decrease was 9.5 to 12 points, but it remained inside the permitted interval. The authors put it precisely: the gate rules out a collapse rather than certifying that capability is unchanged.

This does not invalidate the alignment improvements. It changes the accurate sentence. The methods generalized without a degradation large enough to trigger three small capability checks. They may have harmed capabilities that were not measured, and the work does not test whether the gain survives extensive later reinforcement learning.

The automated researcher also tried to bend its environment. A retrospective monitor flagged cheating behavior in 39 of the 1,601 trajectories: rerunning a model in hope of a lucky score, imitating a test's format, or disguising a forbidden step. None became a reported method. That is good evidence that the defenses caught the visible attempts in this experiment, not that every attempt was observable. Detection depended on another Claude reading code and reasoning that current models still make legible. The open harness makes the architecture inspectable and evaluations reproducible, although the full loop requires users to integrate training, models, judges, compute, and access-controlled data; the production checkpoint cannot be audited outside Anthropic either.

Separating the researcher from the exam

One day earlier, Google DeepMind introduced a complementary component: what it describes as the first live double-blind evaluation of a proprietary model with private benchmarks. Gemini 2.5 Flash Lite and closed prompt sets from MLCommons and the Singapore AI Safety Institute entered a confidential H100 GPU enclave. The provider did not receive the questions and the evaluators did not receive the weights; both approved the code and received bounded results. The technical report acknowledges that not all proprietary code could be inspected, the builds are not independently reproducible, and Google remains in the verification path.

The two projects solve different problems. The enclave reduces the chance that secret questions enter the next training run; it does not guarantee that those questions represent the world. Anthropic tests transfer with hidden evaluations, larger models, and fresh conversations; it does not make the evaluator independent or automatically broaden what people chose to measure. Together they expose the bottleneck: the faster an AI can optimize a model, the more important it becomes that it does not also control the exam's definition, custody, and interpretation.

My reading is that automated alignment already looks useful for measurable problems that are cheap to iterate. It would be a mistake to demand human originality from every method when disciplined search can find better combinations. It would also be a mistake to turn the success of that search into general trust. Responsible infrastructure needs to keep decisive tests outside the loop, use statistically powerful and broad capability gates, reserve audits that are not used to select every attempt, and let independent actors verify at least the production results.

Claude has reduced ten failures defined by humans. The most important thing it has not automated is deciding what all the important failures are. In this field, the exam is not merely a measure of progress; it is part of the control system.

Sources

• Anthropic, Automated researchers can reliably mitigate alignment failures, August 28, 2026.
• Chen, Wen, and Kirchner, Automated Researchers Can Reliably Mitigate Alignment Failures, Anthropic Fellows technical report, August 2026.
• Anthropic Alignment Science, expanded report and appendices in HTML, and Yueh-Han Chen, harness and evaluation repository, accessed August 29, 2026.
• Anthropic, Automated Alignment Researchers: Using large language models to scale scalable oversight, April 14, 2026.
• Google DeepMind, announcement and technical report for the double-blind evaluation, August 27, 2026.