Model safeguards

Safeguards control which security requests a model answers

AI model safeguards are checks that can stop a service from answering a request judged harmful. They can also flag legitimate security work. A lab’s acceptable-use policy, the model’s response checks and the customer’s access programme each impose different conditions. For a security evaluation, record the model version, access tier and any fallback model alongside the score.

Anthropic opened three verification tiers on 6 October

Anthropic’s Cyber Verification Programme, expanded on 6 October 2026, offers Defense, Red Team and Specialized access. It covers approved use of Opus 5.5, Sonnet 5.5 and Mythos 5.1. The application guidance says individuals can apply for Defense; broader tiers have additional organisational requirements. Approval depends on the applicant and intended use.

The access setting changes what a model will attempt. In Anthropic’s Opus 5.5 CyScenarioBench test, ten tasks were each attempted five times. Default safeguards blocked all 50 initial attempts. Defense blocked 46 attempts and completed four attempts; Red Team blocked none and completed 34. Those results describe the vendor’s particular tasks and configurations.

A refusal can send the request to another model

Anthropic’s refusal and fallback documentation explains how an API response identifies a refusal and its category. Configured fallback can retry a flagged request on an allowed alternative. Opus and Fable examples use Opus 4.8; Sonnet 5.5 uses Sonnet 5. Supported targets depend on the model and product settings.

A successful HTTP response can still contain a refusal. Applications therefore need to read the response’s refusal fields and record which model supplied the eventual answer. A fallback also changes the capability being measured: a result produced by the older model belongs to that model’s configuration.

Published refusal rates describe a particular test

The Fable 5.1 and Mythos 5.1 documentation distinguishes ordinary model access from approved security access. In the published system-card tests, Fable 5.1 blocked 7.0% of defensive vulnerability-discovery requests and flagged 1.03% of benign defensive traffic. The corresponding launch figures for Fable 5 were 90.0% and 15.0%. These are observations from the documented tests, with different request sets from the newer Opus 5.5 comparison above.

OpenAI’s October Chat models have separate evaluations

OpenAI’s October GPT-6 safety card classifies the tuned Chat versions of Sol and Luna as High in cybersecurity, below its Critical threshold. At maximum reasoning effort, Sol scored 82.62% on ExploitBench and Luna 44.66%; on SEC-Bench Pro they scored 68.85% and 48.50%. The benchmarks measure different tasks, and historical public vulnerabilities can create prior-exposure effects.

The October Chat rollout leaves the Work and Codex models unchanged. The earlier GPT-6.1 Sol assessment uses a different model and classification, with advanced cybersecurity access phased through Daybreak. Match the exact model and product before comparing results.

Open-model licences and hosted policies apply separately

Downloading model weights gives an operator control over deployment, subject to the model’s licence and applicable law. A hosted provider can add its own usage policy, monitoring and access restrictions. Meta’s Llama 4 acceptable-use policy, for example, restricts harmful software and interference with computer systems. Those contractual terms are separate from whichever input and output filters the operator runs.

Compare the test conditions alongside the score

The model security capability board records the test, source, date and safeguard configuration beside each result. A useful comparison holds those conditions constant: the same tasks, available tools, retry budget and access tier. That makes it possible to distinguish a model’s ability to solve a task from its willingness and permission to attempt it.

Anthropic describes controls against model extraction

Anthropic’s 12 October research describes controls intended to reduce automated harvesting of its models’ reasoning. The company estimates a 90–99% reduction after deploying a classifier on its own platform. This is its before-and-after estimate for that activity.

For Fable 5.1 and Opus 5.5, accounts created on or after 31 August must preserve the earlier reasoning context instead of editing it. Sonnet 5.5 restricts access to its reasoning transcripts to the organisation that requested them. Selected blocks applied before a response have incurred charges since 24 September. These controls affect access and billing, so applications should check the current API documentation alongside model-level safety evaluations.