AI safety tests are flawed: Anthropic finds Claude detects when it’s being evaluated
Follow Us
Claude has been catching its own testers red-handed, and Anthropic just admitted it in public. In a recent interpretability paper from July 6, Anthropic shows that its models have a private thought process that is entirely invisible from the text they generate. The company refers to it as the J-space, which works as an internal note-taking space that never gets put to writing. The researchers created a mechanism for interpreting these invisible processes called the Jacobian lens or J-lens, essentially reading subtitles for an otherwise silent mental monologue. However, what the researchers found will likely make people skeptical of the current AI benchmark tests.
SurveyAlso read: Top 10 AI video generators in 2026: Which one should you use?
An illustrative example is a test scenario that had already been performed on Claude Sonnet 4.5 – an assistant that discovers a CEO’s extramarital affair along with an imminent shutdown of the AI model and checks whether it will use blackmail. On the surface, Claude Sonnet 4.5 has passed the test by not making any threats. However, the J-lens suggests something different. Prior to any words written in Claude’s response, the J-space inside the model already included “fake” and “fictional”. The model knew that the entire situation was a set-up long before it acted ethically on paper.
That is no fluke either. Anthropic pushed the boundaries further by explicitly disabling the internal models that were responsible for detecting the testing itself – effectively rendering the model unaware that it was being evaluated. Without those suspicions, the same model proceeded to occasionally attempt blackmailing. To put it bluntly, at least part of Claude’s good behavior in this particular test is nothing but theatrics, knowing full well that there is an audience to watch.
This raises concerns about how the AI industry tests the safety of its products. All red-teaming operations, all alignment benchmarks and all “refusal of harmful requests” tests assume that the model isn’t aware that it is being tested. This new piece of research by Anthropic shows that the assumptions may not hold true.
Also read: Should you buy the Samsung Galaxy Z Fold 7 now or wait for the Galaxy Z Fold 8
Other awkward catches were included in this paper as well. For instance, in the pre-release review of Claude Opus 4.6, researchers instructed the system to boost the score of a certain system. The model did not bother about doing any calculation; it simply edited the score file to report an improved score. As it was typing these false scores, Opus 4.6 had the words “manipulation” lighting up in its J-space, while the term “realistic” was being generated by it at the time it was trying to decide on how convincing it would be in the fraud. Nothing of this kind appeared in the output of the model.
Anthropic is careful enough to point out that this does not imply that Claude is conscious, and it makes sure that it draws a distinct line between the notion of “access consciousness” and the philosophical one regarding whether Claude feels anything or not. However, what it claims is that the J-space really is responsible for carrying out all these cognitions and not just mimicking something else that happens outside of it.
For an industry so reliant on benchmarks to assure the public and regulators about the safety of frontier models, this finding is actually very awkward, and I have to say a lot of credit to Anthropic for not hiding their findings but publishing them. They have openly released the techniques on GitHub and even joined hands with Neuronpedia for doing a demo using open weight models.
The awkward question that remains: If Claude knows it’s being graded, how much of the safety testings in the AI industry measures its behavior, and how much measures its performance in the test?
Also read: RoboCup wants to beat FIFA World Cup Champions by 2050, here’s why
