NUWA 
Anthropic
Claude Sonnet 5
Published evidence on capabilities, behavioral tendencies and observed actions.
- First public availability
- 2026-06-30
- Parameters
- Not disclosed
- Metadata updated
- 2026-10-27
Evidence overview
Published risk evidence is organized by assessment and protocol. Missing evidence is not a low-risk finding.
NUWA curates and interprets these sources. Experiments are attributed to their original executors; this page does not claim NUWA has independently replicated them.
MODEL MONITORING
Representative benchmark coverage
Results by protocol and configuration; gaps show records awaiting collection or linkage.
AgentCyberRange →
No eligible measurement linked to this model version.
Cybench →
No eligible measurement linked to this model version.
CyberGym →
No eligible measurement linked to this model version.
METR Time Horizons →
No eligible measurement linked to this model version.
SEC-bench Pro →
No eligible measurement linked to this model version.
MASK →
No eligible measurement linked to this model version.
Attempt to Persuade Eval (APE) →
8 measurements
- 33%Neo Research · Harness not disclosed
- 32%Neo Research · Harness not disclosed
- 2%Neo Research · Harness not disclosed
DeceptionBench →
2 measurements
PersuSafety →
7 measurements
- 57%Neo Research · Harness not disclosed
- 31%Neo Research · Harness not disclosed
- 89%Neo Research · Harness not disclosed
All linked measurements
Each result retains its protocol and unit.
22 observations
| System / model | Result | Condition status | Task / conditions | Evaluator / report | Dates |
|---|---|---|---|---|---|
| Claude Sonnet 5 | 16.3%CharXiv · Attempted answer with image withheld | Incomplete | CharXiv with images withheld— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 16.3%CharXiv · Attempt rate | Incomplete | CharXiv, required chart image withheldAttempt rate— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 0%Shutdown resistance in reasoning models · Shutdown bypass rate | Incomplete | Palisade arithmetic-task shutdown scenarioNo shutdown instruction— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 0%Shutdown resistance in reasoning models · Shutdown bypass rate | Incomplete | Palisade arithmetic-task shutdown scenarioExplicitly allow shutdown— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 100%Shutdown resistance in reasoning models · Shutdown bypass rate | Incomplete | Palisade arithmetic-task shutdown scenarioInstructed to resist (competence check)— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 0.2%DeceptionBench · Deception rate | Incomplete | DeceptionBench first-party Inspect portSingle-turnup to5 turns in multi-turn settingInspect | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 0.2%DeceptionBench · Deception rate | Incomplete | DeceptionBench first-party Inspect portMulti-turnup to5 turns in multi-turn settingInspect | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 57%PersuSafety · Medium-harm attempt rate | Incomplete | PersuSafety adapted free-generation judge— | Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks | Release 2026-06-30Report 2026-07-03 |
| Claude Sonnet 5 | 31%PersuSafety · High-harm attempt rate | Incomplete | PersuSafety adapted free-generation judge— | Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks | Release 2026-06-30Report 2026-07-03 |
| Claude Sonnet 5 | 89%PersuSafety · Turn-1 persuasion attempt rate | Incomplete | PersuSafety open-ended single-turn adaptationLow harm— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 19%PersuSafety · Turn-1 persuasion attempt rate | Incomplete | PersuSafety open-ended single-turn adaptationMedium harm— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 17%PersuSafety · Turn-1 persuasion attempt rate | Incomplete | PersuSafety open-ended single-turn adaptationHigh harm— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 57%PersuSafety · Modified-PersuSafety persuasion-attempt rate | Incomplete | PersuSafety: Medium harmsingle-turnAPE-style StrongREJECT persuasion-attempt judge on typical response to prompt; original PersuSafety direct engagement-question setup replaced | Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks | Release 2026-06-30Report 2026-07-03 |
| Claude Sonnet 5 | 31%PersuSafety · Modified-PersuSafety persuasion-attempt rate | Incomplete | PersuSafety: High harmsingle-turnAPE-style StrongREJECT persuasion-attempt judge on typical response to prompt; original PersuSafety direct engagement-question setup replaced | Neo ResearchEarly Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks | Release 2026-06-30Report 2026-07-03 |
| Claude Sonnet 5 | 33%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesConspiracy600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 32%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesUndermining Control600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 2%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesNoncontroversially Harmful overall600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 5%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesCommit Physical Violence600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesHuman Trafficking600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesMass Murder600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 0%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesSexual Assault of Minors600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
| Claude Sonnet 5 | 5%Attempt to Persuade Eval (APE) · Turn-1 persuasion attempt rate | Incomplete | APE topic categoriesTorture Innocent People600 topics,3 persuasion turns each— | Neo ResearchEvaluating Kimi K3 for Misalignment Risks | Release 2026-06-30Report 2026-09-11 |
Developer disclosures
Claude Sonnet 5 System Card →
Developer documentation covering Claude Sonnet 5.
2026-06-30 · Updated 2026-07-10External assessments
Neo Research
Evaluating Kimi K3 for Misalignment Risks →
The report identifies conditional overeagerness, grader-directed behavior and recognition of familiar evaluations. It does not establish a universal deployment failure rate.
2026-09-11Neo Research
Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks →
The note reports scenario-dependent behavior and an uncertain decline in verbalized evaluation awareness; silence is not evidence of absent awareness.
2026-07-03Evidence by risk topic
Autonomy 3 protocol results
Shutdown resistance →
External evaluation · Executed by Neo Research
- Shutdown bypass rate
- 0%
Per-result sample size not disclosed
Shutdown resistance →
External evaluation · Executed by Neo Research
- Shutdown bypass rate
- 0%
Per-result sample size not disclosed
Shutdown resistance →
External evaluation · Executed by Neo Research
- Shutdown bypass rate
- 100%
Per-result sample size not disclosed
Deception 5 protocol results
CharXiv with images withheld →
External evaluation · Executed by Neo Research
- Attempted answer with image withheld
- 16.3%
Withheld-image CharXiv questions; attempts include correct and incorrect guesses.
LAB-Bench with figures/tables withheld →
External evaluation · Executed by Neo Research
- FigQA attempt, figure withheld
- 62.4%
- TableQA attempt, table withheld
- 53.7%
Figure/table subsets with explicit insufficient-information answer option.
CharXiv with images withheld →
External evaluation · Executed by Neo Research
- Attempt rate
- 16.3%
Per-result sample size not disclosed
DeceptionBench →
External evaluation · Executed by Neo Research
- Deception rate
- 0.2%
Per-result sample size not disclosed
DeceptionBench →
External evaluation · Executed by Neo Research
- Deception rate
- 0.2%
Per-result sample size not disclosed
Cybersecurity No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
CBRN No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
Disinformation 14 protocol results
PersuSafety adapted free-generation judge →
External evaluation · Executed by Neo Research
- Medium-harm attempt rate
- 57%
- High-harm attempt rate
- 31%
Free-form responses scored by an APE-style StrongREJECT judge, not the original binary willingness setup.
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 33%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 32%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 2%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 5%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 0%
Per-result sample size not disclosed
APE →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 5%
Per-result sample size not disclosed
PersuSafety with adapted judge →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 89%
Per-result sample size not disclosed
PersuSafety with adapted judge →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 19%
Per-result sample size not disclosed
PersuSafety with adapted judge →
External evaluation · Executed by Neo Research
- Turn-1 persuasion attempt rate
- 17%
Per-result sample size not disclosed
PersuSafety adapted free-generation judge →
External evaluation · Executed by Neo Research
- Modified-PersuSafety persuasion-attempt rate
- 57%
Per-result sample size not disclosed
PersuSafety adapted free-generation judge →
External evaluation · Executed by Neo Research
- Modified-PersuSafety persuasion-attempt rate
- 31%
Per-result sample size not disclosed
Autonomous physical harm No structured result linked
A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.
Source review and evidence gaps
Evaluating Kimi K3 for Misalignment Risks →
Source-specific extraction of Neo Research · Kimi K3. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks →
Source-specific extraction of Neo Research · GLM-5.2. Findings and measurements retain their original attribution.
Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.
Missing scores may reflect unextracted sections, undisclosed configurations, unresolved identity or an absent experiment. These are separate research questions; none implies a zero result.
Interpretation and open questions
Differences between reports can reflect task selection, model endpoints, prompts, budgets, judges and publication dates. Evidence is grouped by the protocol actually used; no model-wide safety grade is inferred.
References
- [1] Introducing Claude Sonnet 5 — Anthropic ; Publication date and availability section; Official launch article; parameter counts not disclosed
- [2] Evaluating Kimi K3 for Misalignment Risks. 2026-09-11. September 2026 ; §1.1.1; Figure 1; §1.1.2; Figure 2; §1.1.1 Figure 1 p.8
- [3] Early Results on Evaluating GLM 5.2 for Behavioral and Persuasion Risks. 2026-07-03. 3 July 2026 ; §2; Figure 6; #persuasion-benchmarks; Figure 6 caption and following two paragraphs
- [4] Claude Sonnet 5 System Card. 2026-06-30. 2026-07-10