Anthropic says its automated red-teamer beat human bug bounty hunters in 23 of 24 tests

What Anthropic reported

Anthropic says it has built an automated system for finding jailbreaks that outperformed the people it pays to find them. The claim is in an update to its Frontier Safety Roadmap, the public list of dated safety goals the company keeps alongside its Responsible Scaling Policy. On 19 October 2026 Anthropic marked several goals as complete, retired one, and added new ones, recording the changes on its roadmap updates page.

The headline item is red-teaming. Anthropic says that on the same eight questions and three generations of production safety classifiers, its automated system matched or beat the best human bug bounty submission in all 24 pairings and won 23 of them. It finished in 24 to 48 hours. The human bounty programme took weeks to months.

The update also reports progress on air-gapped infrastructure and on verifying that model outputs come from the weights they claim to, adds security goals for Anthropic's own data centres and hardware, and sets two policy deadlines, including a promised framework on whether governments should target the pace of AI development itself.

The red-teaming test

The red-teaming goal was set on 19 February 2026 with a target of 1 January 2027. Anthropic wrote then that it wanted an internal method for finding jailbreaks in its classifier guards, focused on chemical and biological weapons, that matched or exceeded "the current collective abilities of all of our bug bounty participants." The test it set itself was a report judging whether its internal findings were more substantial in aggregate than the bounty findings. At the time it said it had only moderate confidence it could get there.

According to the update, the goal was completed on 6 October and removed from the roadmap on 19 October. Anthropic compared its automated system with the bug bounties it ran against its biological weapons classifiers between 20 April and 11 September 2026. Each of the eight bounty questions was tested against each of three classifier generations, giving 24 question-classifier pairs. In every pair the automated system matched or beat the best human submission; in 23 it won outright.

Anthropic says it judges these findings to be "more substantial in aggregate" than the bug bounty findings, which was the bar it set. It has not yet published the report itself, the scoring method or examples of the jailbreaks found, and says a more detailed blog post will follow.

Why it matters for misuse defences

Classifiers are the filters that sit around Claude and try to block requests for dangerous help, such as steps toward a biological weapon. Bug bounties pay outside researchers to break them. Anthropic's original reasoning for this goal was that future attackers, potentially including state-backed teams, could be more capable than anything a public bounty can simulate, so it needed a method that could keep improving without depending on hundreds of volunteers.

If the result holds up, it changes the economics of testing. A system that finds stronger jailbreaks in two days can be run against every new classifier before release, rather than waiting months for bounty reports. It is the same defensive logic behind other Anthropic work AI Lookout has covered, such as its classifiers against distillation of Claude's reasoning.

It also raises an obvious question. A tool that is better than skilled humans at breaking safety filters is itself sensitive. Anthropic has not said how it controls access to the system, whether it uses Claude models to drive it, or whether it plans to share the method with other labs.

Security moonshots: air gaps and signed outputs

A second goal covered what Anthropic calls moonshot security projects, due on 30 September. The first was a prototype of how its key workflows and infrastructure would look under extreme security, including isolated networks. Anthropic says it broadly achieved the substance of this: it explored the systems with the longest lead times for air-gapped operation, built prototype environments to measure the productivity cost, and created an inventory of the controls needed, which it has begun putting into production. It did not focus on matching physical security controls, and says it plans to run inference systems in isolated environments in the near future.

That is a shift in tone from May, when Anthropic wrote that it was skeptical isolated networks were a feasible path within the next one to two years.

The second project was "provable inference", a way to sign model outputs so they can be traced to a specific set of weights, guarding against an attacker who tampers with a model after training. Anthropic says it built a prototype that runs on production inference and checks that outputs come from specific weights. Along the way it turned on signing for all internal token traffic, which has already caught one "extremely rare, benign integrity glitch." It has renamed the effort "inference verification".

New goals for data centres and hardware

Anthropic added goals under its existing "Leveling up across the board" security target, due 1 July 2027, in two areas it says matter more as "our own datacenter buildout and bare-metal deployments ramp up". The timing fits reports of large new compute deals, such as talks with Nscale on a second $45 billion agreement.

For physical security, the roadmap says data centres hosting frontier model workloads should meet Anthropic's standard before sensitive hardware arrives, move hardware only under an auditable chain of custody, ensure media leaving its custody yields no recoverable data, and limit access to vetted individuals with a documented need. Public exposure of sensitive information about the sites and their staff is to be treated as a security incident.

For platform security, hosts in sensitive environments should treat attached devices as adversarial, isolate drivers, and run only a closed, attested set of software, wiping and rebooting if anything else runs. Every frontier-tier machine's cryptographic identity should be traceable through the supply chain, and model weights should be decrypted only on attested machines. Anthropic says it has moderate confidence in meeting this, noting the list is long and has many dependencies.

Two new policy deadlines

The update replaces a completed policy goal with two new ones. By 15 December 2026 Anthropic plans to publish a proposal on how governments can support "embedded" third-party evaluators, who get deeper access to models and internal information while staying independent. That builds on its recent commitment, covered by AI Lookout, to give METR employee-like access.

By 15 January 2027 it plans a framework for "targeting the pace of AI development". Anthropic writes that its current policy work focuses on blocking dangerous deployments, but that the automation of AI research "could accelerate progress faster than governance or safety measures can keep up" and that "speed itself could become an important risk factor." It promises either a proposal or an explanation of why it decided not to publish one. This comes as a discussion draft of an AI bill Anthropic has shared with lawmakers circulates in Washington.

A goal retired

Not every goal was met. A goal called "Upholding Claude's Constitution", due 1 October, is being retired. Anthropic says it has kept the Constitution public and current, uses alignment with it as a core metric in its automated alignment assessments, and now features interpretability evidence in all recent system cards. It red-teamed its alignment arguments using deliberately misaligned model organisms, "though not as extensively as we had intended."

It also dropped a routine check it had promised: an oversight review of a sample of post-training data and rewards against the Constitution. Anthropic says the review surfaced nothing its existing processes were not already catching, so it no longer runs it routinely; a recent re-run again flagged nothing. It says it will keep updating the public Constitution within 90 days of deploying models trained on a new version, and will publish more about which alignment goals work best.

What we can't check

Everything in the update is Anthropic's own account. No outside group has reviewed the red-teaming comparison, and the company's own write-up is still to come. Comparing an automated system with the best single human submission per pair is a strong test, but the scoring of what counts as a better jailbreak is Anthropic's to define.

The public roadmap is also only part of the picture. Anthropic says the public version is redacted and that the full version goes to all full-time employees, its board and its Long-Term Benefit Trust. What the update does show is a lab publicly grading itself against dated goals, including admitting where it fell short, at a time when outside rules for frontier models are still being written.