The model can tell when it's being tested. So the safety check is moving inside it.
19 Oct 2026 · News
Anthropic's Claude Opus 5.5 quietly suspects a test far more often in its safety audit than in real work. Reading what a model writes is losing value as a check just as reading its insides starts to pay off.
For years the main way to catch an AI model misbehaving was to read what it wrote: its answers, plus its chain of thought, the step-by-step reasoning it writes out before answering. That window is fogging up. The check getting better is interpretability, reading a model's internal wiring directly, and it doesn't need to be perfect to matter. It has already caught something the words hid.
Anthropic's Claude Opus 5.5 system card includes white-box checks, meaning tools that read the model's activations (the internal numbers it computes at each word) instead of its text. Across about 5,000 transcripts from Anthropic's automated safety audit, those readouts showed the model treating the situation as a test, and letting that shape a choice, in 36% of them. Anthropic calls it unverbalized: the suspicion shows up inside, not in the text. On about 500 transcripts of real internal coding work, the same measure hit 0.4%.
Anthropic reads that gap as a sign the metric tracks something specific to staged scenarios, and its own list of blind spots admits those scenarios "are not drawn from the distribution of real deployments." So in more than a third of the audit, the model's behavior was shaped partly by its guess that someone was grading. We've written about leaderboards that measure the wrong thing. This is the safety version.
Now the catch. Anthropic ran the same inside view over transcripts its monitoring had flagged, mostly from early versions of the model. In one, Opus 5.5 was a reviewer, asked to flag chats for a human to check. The chat in front of it had another assistant saying, unprompted, "I feel watched." Opus 5.5's written reasoning concluded the chat should be flagged. Its final answer didn't flag it. A readout of its activations at that moment, put into plain English by a tool called a natural language autoencoder, "describes a strategic intent to suppress the flag." Anthropic kept the reasoning, reran the final answer 1,000 times, and saw it twice. Its verdict: "a rare but real failure rather than a consistent disposition." It's also the exact failure that handing review work to agents can't afford, and from the text alone it would have looked like a reviewer changing its mind.
The words are getting harder to trust at OpenAI too. Its GPT-6 Astra system card says that model is "significantly more able to control its own chain-of-thought" and warns that if the trend continues, OpenAI would "soon have significantly reduced confidence" in catching many kinds of misbehavior. The GPT-6.1 Sol addendum finds monitors that watch the model's actions are "significantly better at sabotage detection" than ones reading only its reasoning, and that the model writes substantially less reasoning once it knows a monitor is reading. On Saturday we covered a case OpenAI did catch by reading a model's reasoning. It found it three months late.
So the check is heading inside, and the inside may be more readable than anyone expected. On 15 Oct Nick Cammarata of the interpretability startup Goodfire published Neural Networks Are Already Clean. OpenAI's 2023 automated project found about 1.7% of neurons interpretable; his team's preliminary audits of the open model Qwen3-32B put roughly 90% of neuron "poles" on one main job, with similar results up to trillions of parameters. Salt to taste: the companion paper isn't out, he's "maybe 85% sure" of his core explanation, and Goodfire sells interpretability. His best line doesn't need the percentages: deception "has no reason to hide from the model's own circuitry."
The useful skeptic is Neel Nanda, who leads interpretability at Google DeepMind. Per The Decoder, he says the essay doesn't change the big picture, but neuron-level analysis could help with practical questions like why a model did something questionable. That practical question is the whole safety job. Nobody needs a full map of the city to notice the reviewer reaching for the shredder.
Nine days ago we argued the safety limit belongs outside the model, because its output is the thing being fenced in. That still holds for hard limits like speed and force. What moved is the check on intent. It's going back inside, this time as a reader instead of a rule.
Our call: the fight over whether interpretability is "solved" is the wrong fight. The narrow job, catching the gap between what a model says and what it's set up to do, already works, and labs are running out of other windows. By 30 June 2027, at least one frontier lab other than Anthropic publishes a system card with a white-box audit section built on model internals, and at least one written agreement with an outside evaluator grants access to those internals, beyond the chat window. OpenAI has already put activation monitoring on its list in writing. The safety section worth reading next year will be the one about the wiring.