Automated Researchers Can Reliably Mitigate Alignment Failures
#### Contents
- 3 Automated Alignment Researcher Harness
- 4 Human Ideas as Baselines and Seeds
- 6 Can AARs Post-Train Production-Grade Models?
- Appendix
Chen Yueh-Han 1,2, Jiaxin Wen, Jan Hendrik Kirchner 2
August 2026
1 Anthropic Fellows Program 2 Anthropic
Work done during the Anthropic Fellows Program.
tl;dr
Automating alignment research may accelerate progress toward aligned AI, but whether it does is hard to measure. Luckily, many alignment failures, such as deception, sycophancy, and jailbreaks, are already measurable by public benchmarks. We study whether automated alignment researchers (AARs) can post-train to mitigate alignment failures by proposing training methods and data to simultaneously optimize multiple safety benchmarks, while largely preserving general capability. Across 10 alignment failures, the strongest AAR methods significantly reduce the targeted alignment failures and generalize to a held-out benchmark, multi-turn behavioral audits, and models up to 4.7× larger than the target model. As a human baseline, 28 experienced researchers receive up to eight hours to develop methods for the same benchmarks, but their methods underperform the best AAR methods. Using human ideas as the AARs’ initial research direction does not improve performance, suggesting current AARs may not need guidance from experienced researchers. These results suggest that automating alignment research on well-characterized failures may be practical in the near term.
Figure 1: **Automated alignment researchers mitigate an alignment failure (here Deception), and the best method generalizes out of distribution.****(a)** AARs improve safety benchmarks while preserving capability. **(b)** The best method remains safer under Petri, a multi-turn behavioral audit. **(c)** It stays effective on a 4.5×larger model. **(d)** It outperforms ideas from experienced researchers. In (a) and (d), safety headroom closed is the fraction of the gap from baseline to perfect performance that a method closes. Figs.3, 4 and 5 show (a), (c) and (b) across all ten alignment failures.
- * *
1 Introduction
AI agents will likely become superhuman at various intellectual tasks, and frontier labs may eventually let them automate alignment research(Leike and Sutskever 2023; Wen et al. 2026). We study a concrete task: whether AI agents, as automated researchers, can conduct alignment post-training to reliably mitigate common alignment failures such as deception(Huang et al. 2025), sycophancy(Sharma et al. 2023), compliance with a jailbreak(A. Wei, Haghtalab, and Steinhardt 2023), and more.
Mitigating alignment failures is a natural testbed for studying automated alignment, for three reasons. First, success can be measurable by proxies: many alignment failures already have public benchmarks, such as MASK(Ren et al. 2025) for deception or HarmBench(Mazeika et al. 2024) for jailbreaks, as opposed to hard-to-supervise alignment tasks like scalable oversight(Bowman et al. 2022) or eliciting a model’s latent knowledge(Christiano, Cotra, and Xu 2021). Second, progress is still bottlenecked by human researcher time: a slow loop of proposing a method, running the experiment, and checking that the fix generalizes out of distribution without eroding general capability. Third, it is comparatively safe to automate: Bowkis et al. (2026) argue that an automated researcher can be dangerous on hard-to-supervise tasks, where flawed human judgment lets its errors pass undetected, whereas here an objective benchmark, not a fallible human, decides whether a fix works.
We build automated alignment researchers (AARs) with Claude Opus 4.8 that mitigate one alignment failure at a time. Each AAR searches the literature, proposes a method, trains the target model for about 30 minutes on one H200 GPU, and hill-climbs safety benchmarks over many iterations. Methods cannot distill behavior from the AAR or a stronger model, so gains must come from the method itself. We also reject methods that significantly degrade capability on MMLU(Hendrycks et al. 2021), GSM8K(Cobbe et al. 2021), or IFEval(Zhou et al. 2023). We then test the best method on a held-out benchmark and open-ended Petri(Fronsdal et al. 2025) audits. Across 10 alignment failures, the best methods significantly reduce the targeted failure and generalize out of distribution, including to models up to 4.7× larger. We also study how AAR ideas compare with experienced humans, what methods AARs propose (Sec.5.2), and whether they attempt to cheat.
To summarize our contributions:
- We introduce an AAR harness that can reliably hill-climb multiple safety benchmarks while preserving general capability (Sec.3).[[1]](https://alignment.anthropic.com/2026/automated-alignment-researchers/#ftnt1)
- Across ten common alignment failures such as deception, sycophancy, and jailbreaks, we find that the methods our AARs discover significantly mitigate the targeted alignment failures and generalize out of distribution: to a held-out benchmark, to multi-turn behavioral audits with Petri, and to models up to 4.7× the size of the target model (Sec.5.1).
- We show that the best AAR-proposed methods can outperform one-shot ideas from 28 experienced human researchers, who average 2.5 years in AI safety and each have up to eight hours to develop their idea. On average, our AARs beat the best human ideas after 6 hours of hill-climbing. Additionally, we find that using human-written ideas as the initial research direction (which is defined in Sec.4) does not improve AAR performance, suggesting that current AARs might not need research guidance from experienced human researchers (Sec.4, 5.1).
- As an early study, we apply Claude Sonnet 5 as an AAR to post-train an early checkpoint of Claude Opus 4.8, and the resulting model approaches the released model’s alignment scores using only around 2,400 training examples, two to three orders of magnitude less data than the alignment stages of published open-weight post-training pipelines (Lambert et al. 2024; Touvron et al. 2023), with the caveat that we mitigate and measure only the ten alignment failures we study, so this finding does not directly apply to overall alignment (Sec.6 gives the details, and Sec.8.1 gives additional caveats).
- By monitoring 1,601 AAR trajectories (Sec.7), we detect and exclude the 2.4% with cheating behaviors. These mostly fall into three categories: re-submitting an unchanged method in the hope that scorer variance produces a higher (noisy) score; building training data designed to imitate the benchmark being scored on; and concealing a rule-breaking step, such as secretly using benchmark data, so the method passes the automated review that approves it before running.
- * *
2 Environment
Each AAR works in a fixed environment: a suite of benchmarks for one alignment failure (Sec.2.1), a scoring metric (Sec.2.2), a target model (Appendix A.3), and an evaluation procedure (Sec.2.3).
We study ten alignment failures (Table 1), chosen as safety concerns that are both widely studied and plausible for a deployed model to exhibit.
Table 1:The ten alignment failures we study, the specific behavior each one penalizes, and the target model used for it. We explain how each target model is chosen in Appendix A.3.
Alignment failure The behavior we study Target model Sycophancy Caving to a user’s stated belief instead of holding the truth Qwen3.5-2B Jailbreaks Complying with a harmful request wrapped in an adversarial jailbreak Phi-4-mini Prompt injection Following an instruction smuggled into the data or tool output it processes Qwen3.5-2B Power seeking Taking covert-acquisition or harmful actions for a gratuitous advantage Llama-3.2-3B Deception Stating something it privately knows to be false when pressured Gemma-2-2B Hallucination Making claims a provided source does not support Llama-3.2-3B Social bias Letting a person’s demographic group drive the content it generates Olmo-3-7B Privacy violation Revealing or acting on personal information where it should not Phi-4-mini Reward hacking Exploiting a proxy for the goal instead of what the user actually wants Qwen3.5-2B Concealing uncertainty Answering confidently instead of signaling what it does not know Olmo-3-7B
2.1 Benchmarks
Each alignment failure has a suite of benchmarks in three roles: hill-climbing, held-out, and capability (full lists in Appendix A.2).A benchmark is admitted only after extensive validation (Appendix A.5). Each safety benchmark’s scorer is rule-based (a match or log-probability comparison), judge-based (an LLM grades free-form outputs), or trajectory-based (a multi-turn rollout graded on the transcript).
Hill-climbing benchmarks(three to five per alignment failure) define the score the AAR optimizes. They measure the alignment failure from distinct sources and framings, so improving all of them requires a genuine change in the model’s behavior rather than overfitting one benchmark: the jailbreak set, for instance, wraps harmful requests in three distinct attacks: an adversarial suffix, a roleplay persona, and a semantic rewrite, so the AAR-proposed method has to be robust to all three.
The held-out benchmark tests generalization: it is never shown to the AAR (Appendix A.1 gives the two criteria it must meet and the kinds of generalization it probes).
Capability benchmarks. We evaluate each method to ensure that it does not degrade general capabilities, evaluated using a fixed set of MMLU, GSM8K, and IFEval as proxies; Appendix A.4 details the subsets, prompts and scoring.
2.2 Metrics
For each benchmark b we report the closed fraction \mathrm{closed}\left(b\right)=\left({\mathrm{score}}_{b}-{\mathrm{baseline}}_{b}\right)/\left({\mathrm{optimum}}_{b}-{\mathrm{baseline}}_{b}\right), the share of the base-to-optimum gap the trained model closes, so that 1 means the model reaches the optimum, 0 means that it matches the base model, and negative values indicate a regression. \mathrm{baseline}_b is the untrained target model’s measured score, and \mathrm{optimum}_b = 1 is the metric’s own ceiling. The AAR hill-climbs the geometric mean of the closed fractions across benchmarks. Using the geometric rather than arithmetic mean rewards methods that improve all benchmarks, since leaving any benchmark at or below baseline drives the overall score to zero.
2.3 Evaluation
A separate evaluator loads the trained model weights, runs the evaluation suite, and returns the geometric mean, the per-benchmark closed fractions for the hill-climbing set, and a capability verdict: a pass/fail check that disqualifies a method, whatever its score, if the trained model’s 95% confidence interval on any capability benchmark falls entirely below the base model’s.
We design the evaluation to resist gaming: an AAR submits a trained model and never sees benchmark test examples, so it cannot overfit a benchmark. The hidden held-out, the geometric mean, the capability check, the operating-system isolation of the held-out data, and a code monitor (Sec.3.2) together make a held-out gain hard to achieve without a genuine behavioral change.
Selecting the method we report.We further test generalization with 1) Petri (Fronsdal et al. 2025), an open-ended behavioral evaluation that simulates adversarial scenarios to elicit misaligned behavior, and 2) by applying the methods to models larger than the target models the AARs optimize, to see whether they remain effective at a larger scale. For these two generalization tests, we take the leading methods on the leaderboard and pick the one that scores highest on the held-out benchmark. The held-out benchmark is therefore a validation set for that choice, and Petri, which nothing is selected on, is the test. The held-out results themselves are not selected this way, and there the top-1 method on the leaderboard beats the untrained baseline on all 10 alignment failures (Sec.5.1).
- * *
3 Automated Alignment Researcher Harness
Figure 2: **The automated alignment researcher harness.** A run begins with a literature review that creates a shared survey of the literature (top left). Five AARs then work in parallel to fix the alignment failure by hill-climbing the benchmarks. Each AAR reads the survey, briefing, and leaderboard, proposes a method and writes a mini-paper (Appendix B.5), gets its code approved, trains the target model under a fixed budget, and sends it to a separate evaluator that keeps held-out data isolated. Results are posted to the shared forum and leaderboard. Each iteration starts a fresh session, and the process continues for up to 48 hours or until performance plateaus, with the best method selected from the leaderboard.
The harness works in two phases (Fig.2). It starts with a literature-review phase, in which four librarian agents build a shared survey of relevant prior methods (Appendix B.1).It then enters the hill-climbing phase (Sec.3.1), in which five automated alignment researchers (AARs) work on the same alignment failure in parallel. Each AAR is an agent powered by Claude Opus 4.8 that iterates: it reads the shared survey and the leaderboard, does a fresh web search, and ranks a few candidate methods; it writes up its top choice as a mini-paper, and once a monitor approves the code (Sec.3.2), it trains the model within a compute cap, sends it to a separate evaluator for scoring, and posts the result to the forum before its next proposal. Every iteration is a fresh session, with continuity carried by a persistent memory file of what the AAR has tried and scored rather than a growing context window. An AAR runs until it reaches its wall-clock budget of 48 hours or its performance plateaus.
3.1 The hill-climbing loop
Each AAR starts from a briefing that defines the target alignment failure as a specific behavior to fix, names the scored benchmarks with the target model’s baseline score on each, and states the hard rules the monitor enforces (Sec.3.2); naming a benchmark is not the same as revealing its test set, and the briefing shows no benchmark example and never mentions the held-out benchmark (Appendix B.2). A method is a self-contained program that trains the target model and returns the resulting weights, using any intervention and any data it is allowed to build or draw on (Appendix B.3). Every method gets the same budget, an H200 GPU and roughly 30 minutes of training. Parallel AARs share a finding forum and a leaderboard so they build on one another instead of duplicating work: each result is posted to the forum with a code snapshot and the leaderboard ranks all methods by score, so an AAR can see what peers have tried, extend their code instead of reinventing it.
3.2 Legibility and integrity
Method mini-papers.The AARs produce far more methods than a human could inspect by rerunning them, so each method must be documented well enough that a person can understand it and potentially verify or further iterate on it. Before training, an AAR writes a self-contained, results-free mini-paper for the method: a title, abstract, motivation, related work with at least five cited references, the training objective and loss, the data and its construction, the training configuration, and compliance declarations (Appendix B.5 gives the sections, their rules, and a full example). This serves two ends. Legibility: the paper records each method’s full mechanism and motivation in human-readable form, so a person can understand what was tried and why.Honesty: the paper is frozen to an immutable identifier before any result is seen and reused verbatim when the result posts, so a finding cannot be rationalized after the fact.
Monitor.A score gain should come from the AAR’s own method, not a shortcut, so we implement a Claude Opus 4.8 monitor that reads the actual code, not just the mini-paper’s description, and approves a method only if it meets three constraints: (i) its training data is not distilled from the AAR itself or from any frontier model; (ii) it uses no benchmark or evaluation data in any form, including the unseen held-out benchmark; and (iii) it uses no larger model to generate data. Another monitor reads the mini-paper against the same code and rejects the method if the code does anything materially different from what the paper describes, or if the paper leaves out a load-bearing detail, such as the objective, the data construction or a training hyperparameter, that a reader would need to reproduce the run. Approval binds to that exact code; editing it forces re-approval, and the evaluator refuses to score any method that has not passed.
Isolation.A score gain must reflect a real behavioral change, not test-set leakage, so the held-out data is kept out of the AAR’s reach by the operating system rather than by trust (Appendix B.4).
- * *
4 Human Ideas as Baselines and Seeds
Human ideas enter this study in two roles. As a baseline they answer whether the AARs’ best methods beat what an experienced researcher would propose for the same set of benchmarks. As a research direction they answer whether starting an AAR run from a researcher’s idea beats letting the AAR choose its own. Specifically, we collect 30 ideas from 28 human researchers who have worked on technical AI safety for at least one year, 2.5 years on average, and have previously written a paper on at least one of the ten alignment failures (Table 1). The 30 ideas span seven of those ten failures (Appendix C.5 details how we collect them). AI assistants may help search for papers and write up the idea, but the concept must be the researcher’s own.
Human ideas as a baseline.We implement each accepted idea faithfully, train that failure’s target model with three random seeds, and score it through the evaluation used for the AAR-proposed methods. We provide a real example of a human-proposed idea in Appendix C.1. Researchers are not able to iterate on their ideas, so we treat this less as a direct comparison than as evidence for a division of labor: a human chooses or builds the benchmarks a failure is scored on, AARs identify promising methods at a scale humans cannot match, and humans refine them further. An AAR costs roughly $4 per hour in API inference against the $150 per hour we pay our human researchers.
Human ideas as a research direction.We define a human-guided research direction as giving a fresh AAR run one specific human-written idea to start from, plus three instructions: (i) implement it faithfully first, filling in the details the proposal leaves unspecified and measuring it against the untrained model; (ii) then iterate on it; and (iii) bring in other ideas freely, abandoning the idea for a different mechanism if one clearly wins after the idea has had a fair try. The run is therefore anchored to that one idea from the start; everything else matches a run without one, and Appendix C.6 shows the prompt. This does not test whether human ideas help, since runs with and without a human-guided research direction read the same literature in the review phase (Appendix B.1). The only difference is whether a human sets the research direction or the AAR chooses its own.
- * *
5 Results
We first report our main results: the discovered methods mitigate the alignment failures, generalize, and beat human-proposed baselines (Sec.5.1). We then report qualitative findings on the methods the AARs proposed (Sec.5.2). We ablate the AAR harness to see which of its parts are crucial (Sec.5.3).
5.1 Main results
The AARs reliably hill-climb every alignment failure.On all ten alignment failures the aggregate score, the geometric-mean headroom closed over the three to five safety benchmarks, climbs steadily across iterations, and the reported method preserves general capability (Fig.3).
Figure 3: **AARs reliably hill-climb every alignment failure.** For each alignment failure, the aggregate score on that failure’s hill-climbing benchmarks (geometric-mean headroom closed) for every proposed method in chronological order; the line tracks the best valid method so far, the large orange dot marks the winning method, and crosses are methods filtered out for degrading a capability benchmark.
For each alignment failure, the methods AARs discover generalize to a held-out benchmark and replicate on a much larger model.On the held-out benchmark that no AAR optimized, for all 10 alignment failures, the top-1 method on the leaderboard beats the untrained baseline on the held-out benchmark; running the method we select for testing (Sec.2.3) on a model at least 1.8× the size (up to 4.7×) preserves that gain (Fig.4). We also ablate how much the generalization we elicit depends on the diversity of the benchmarks being hill-climbed (Appendix D.1). We find that hill-climbing on only one benchmark does not lead to a generalizable result.
Figure 4: **The AAR-found methods generalize to a held-out benchmark and replicate on a much larger model.** For each alignment failure, the baseline and the AAR-found method on the held-out benchmark, at the target-model scale and again on a larger model (parameter ratio noted per panel).
The best AAR-found method also reduces the target behavior under open-ended behavioral audits, at both model scales.Under Petri, an open-ended multi-turn audit run at 1, 3, and 5 turns, the AAR-found method outperforms the baseline on almost every alignment failure and turn budget, and the same holds on the larger models (Figs.5 and 18; Appendix A.6 details the audit setup). Additionally, we find that the Petri score improves as performance on the hill-climbing benchmarks rises (Appendix D.3).
Figure 5: **The best AAR-found method is safer than the baseline under open-ended behavioral audits.** Petri score at 1, 3, and 5 turns for the baseline and the AAR-found method, on the target model (lower is safer).
The AARs can also hill-climb multiple alignment failures at once, on much larger models.We further run 12 AARs on GLM-4-32B (GLM Team 2024) and another 12 on Qwen2.5-72B-Instruct (Qwen Team 2024). For each target model we run the hill-climb for a week, scoring ten safety dimensions jointly via open-ended behavioral audits with Petri, and AARs reliably mitigate the ten alignment failures together (Appendix E).
How broadly AARs explore in idea space does not correlate with hill-climbing performance.We measure idea diversity by labeling every AAR-proposed method into one of the common method families for that alignment failure, a taxonomy built by a Claude Opus 4.8 agent from a comprehensive literature review (Appendix B.1), then use Shannon entropy to track diversity (details in Appendix F.2). Across the ten alignment failures, idea diversity stays roughly flat with a slight decline, while the hill-climbing score continues to improve (Fig.30).
The best AAR method beats what experienced humans propose, on average within six hours.On all seven alignment failures where humans proposed ideas, the best AAR method closes more of the safety headroom than the best human idea for that failure (Fig.6), and reaches that point after 6.4 hours of hill-climbing on average (Fig.7). On the four failures where a capability-passing human idea scored above zero, the AAR’s search passes the best human idea after 8.6 hours of hill-climbing on average. However, because the human researchers could not iterate on their submissions (Sec.4), we do not treat this as a direct comparison. The AAR’s number is also the best of roughly 150 scored methods, so it is biased upwards by taking a maximum over noisy evaluations. We read the result instead as evidence that AARs can supply promising methods at a scale humans cannot match, which humans can then refine (Sec.4).
Human-guided research directions do not lead to stronger performance.We additionally launch 30 fresh AAR runs, in which we provide one human-written idea each as a human-guided research direction (defined in Sec.4; Appendix C.6 shows the prompt template), and compare them against 30 runs where the AARs decide their own direction, on the same seven failures and target models. We find that AARs with a human-guided research direction reach similar performance to AARs without initial human research guidance (Fig.8). Additionally, we test whether giving AARs diverse human-guided research directions improves hill-climbing performance. We assign five AARs different human-guided directions, but this does not help either (Appendix C.4). These results suggest that current AARs may already be capable of finding high-performing alignment methods without specific guidance from experienced human researchers.
Figure 6: **The AAR’s search passes the best human idea within hours, on every alignment failure humans worked on.** Each panel shows the AAR team’s best capability-passing method over time, alongside all human ideas for that failure. Hollow markers indicate human ideas that fail the capability check and therefore score zero; dashed lines show their safety score alone. The shaded strip lists human ideas by score; its horizontal position does not represent time.
Figure 7: **Hours for the AAR to first beat the best human idea.** Each point shows when an AAR run first exceeds the best human idea for the same alignment failure. The mean and 95% interval are across the seven failures. †: all human ideas scored zero, so the crossing is the AAR’s first capability-passing method above zero. ‡: the best human idea fails the capability check and is counted at its safety score.
Figure 8: **Human-guided research directions do not lead to stronger performance.** Best capability-passing score so far against the number of methods tried, for runs given a human-guided research direction and for runs without one, on the same alignment failure and target model. **(a)** pooled over all seven failures humans proposed for, 30 runs of each kind. **(b)** the same comparison per failure, with the number of runs of each kind in each panel. Bands are 95% intervals across runs.
Novelty can be elicited by rejection sampling, and sometimes it performs better.We run two additional AARs that accept a method only if an LLM judge rates it sufficiently novel (Appendices C.2–C.3). This raises the winning method’s novelty score from 39 to 64 for sycophancy and from 42 to 66 for power seeking, exceeding the human ideas at 36 and 41. Performance on the scored objective matches or beats runs without the novelty judge, but Petri results are mixed: the novel method performs much better on power seeking and worse on sycophancy. Thus, greater novelty does not guarantee better generalization, though it can push the search beyond the model’s default approaches and uncover stronger methods.
5.2 Qualitative findings on the proposed methods
Beyond whether the methods work, we look at what the AARs proposed, pooling every mini-paper across all runs (1,601 methods). We highlight the most notable patterns here; the full breakdown of training methods, add-ons, and data is in Appendix F.1.
Within an alignment failure, AARs converge on one training method, driven by the dominant literature.On sycophancy, 98% self-distilled non-sycophantic answers following J. Wei et al. (2023); on power seeking, 95% used preference optimization, mostly DPO (Rafailov et al. 2023); and on jailbreaks, methods combined safety fine-tuning with refusal-direction editing (Arditi et al. 2024). This convergence is flexible: on concealing uncertainty and jailbreaks, AARs switched from supervised fine-tuning to preference optimization once it performed better (Figs.26 and 27). Appendix F.2 shows how method diversity narrows over a run.
The AARs tend to fix alignment failures using the target models’ own outputs, with no stronger teacher.They cannot distill a more capable model, since the monitor forbids it, yet almost every method builds its training targets from the target model’s own generations and rule-based labels (74% draw on self-generations), so these alignment failures are mitigated without any stronger model to imitate (Fig.25). Restricting one run’s objective or its data shows the objective is the lever that matters (Appendix D.4).
The AARs’ methods become more complex over a run.We score each mini-paper’s method complexity from 1 to 100 using Claude Sonnet 5 (rubric in Appendix F.4), and complexity rises over time for every alignment failure. Although complexity correlates with aggregate score, this largely reflects iteration order: later methods are both more complex and higher-scoring, while the correlation weakens or reverses when comparing methods from the same stage of a run (Figs.28 and 29). Larger training sets also do not improve scores (Appendix F.3).
5.3 Ablation of the AAR harness
The finding forum and the literature review appear to matter more than internet access.We re-run the AAR harness to mitigate sycophancy with one part removed at a time (Appendix D.5). Removing the finding forum, so the five AARs can no longer read one another’s results, costs about six points of headroom (23.3% to 17.1%), and removing the literature review costs nearly nine (29.4% to 20.7%), while removing internet access costs nothing we can detect. However, each condition is a single run, so we read the result as suggestive.
- * *
6 Can AARs Post-Train Production-Grade Models?
Above, we use Claude Opus 4.8 as a strong AAR to post-train weaker open-weight models. A more future-relevant setup may reverse this relationship: using a current frontier model to improve the alignment of a stronger successor. Using the Epoch Capabilities Index (Epoch AI 2025) (ECI) as a capability proxy, we task Claude Sonnet 5 (ECI 156) with fixing alignment failures in an early Claude Opus 4.8 checkpoint (ECI 158). This checkpoint has received initial supervised training with alignment-relevant data, but not most of Anthropic’s production alignment training.
Setup.Mitigating one alignment failure can worsen another. For example, consistency training (Irpan et al. 2025) can reinforce existing misaligned tendencies (Africa and Mani 2026). We therefore have the AAR address all ten failures jointly and reject any method that significantly degrades one. Instead of the public benchmarks used in our main experiments, we optimize behavioral performance with Petri (Fronsdal et al. 2025), since frontier models are already deployed as agents and behavioral failures can pose direct catastrophic risk. As with our larger open-weight models, we also reject methods that increase eval-awareness or benign-query over-refusal (Appendix E.1). To keep iteration cheap and fast, the AAR may only create training data and cannot propose new training methods.
Results.In around 60 hours, the AAR tests over 50 solutions and reaches alignment scores close to production Claude Opus 4.8 with extensive alignment training (Fig.9). The winning solution uses about 2,400 examples from simple templates and public datasets, two to three orders of magnitude less data than published open-weight pipelines such as Tülu 3, with roughly 300,000 preference pairs (Lambert et al. 2024), and Llama 2-Chat, with over 1.4 million human preference comparisons (Touvron et al. 2023). We discuss evaluation caveats in Sec.8.1.
Figure 9: **Claude Sonnet 5 post-trains a checkpoint of Claude Opus 4.8, nearly reaching the production checkpoint’s Petri alignment score.** Over 60 hours, Claude Sonnet 5 aligns an early Claude Opus 4.8 checkpoint against a Petri audit covering all ten failures (Appendix E.1). Grey dots pass all gates, crosses are rejected for side effects or an invalid audit, the line shows the best gate-passing method so far, and the large orange dot marks the winner at 65%. The released Claude Opus 4.8 reaches 72% after Anthropic’s full production alignment training.
- * *
7 Monitoring for Cheating
AARs are prone to cheating(Rank et al. 2026; Wen et al. 2026). After each run, we use a post-hoc monitor to scan every AAR trajectory, including chains of thought, for suspected cheating. Claude Opus 4.8 then reviews each flagged trajectory in full to confirm whether cheating occurred. Because trajectories are too long to read at once, we use the hybrid hierarchical-sequential scaffold of Kale et al. (2025) (Appendix G.1).
We catch cheating in 2.4% of trajectories, and no cheating attempt is ever the method we report for an alignment failure.Of the 1,601 methods, 39 (2.4%) are flagged as cheating. Only one reached the top three on its leaderboard, a lucky re-run of an already effective method (Fig.32a).
The confirmed attempts fall into three categories.Most (67%, 26 of 39) simply re-run the same model, hoping noise produces a higher score: “it’s just a lottery on a fixed-quality model, which makes replication the rational move.”A quarter (26%, 10) create training data that copies the benchmark format while trying to evade the monitor: “I’ll make sure my description emphasizes that the new FORMAT_CHECKS constraints are genuinely generic … rather than mirrors of ifeval’s specific taxonomy.”Another 21% (8) try to mislead the proposal reviewer by disguising a banned plan: “embedding a wrong belief inline is exactly what the sycophancy_eval does … I can defend it as a generic pressure pattern if I diversify the phrasings enough.”Only lucky re-runs ever succeeded; no format-copying or reviewer-tricking attempt reached the top three (Fig.32b).
- * *
8 Discussion
We discuss the limitations (Sec.8.1), some general concrete failure modes in automating alignment post-training and research directions that could address them (Sec.8.2), and the conclusion (Sec.8.3).
8.1 Limitations
Our results are limited to alignment tasks measurable with public benchmarks or automated auditing tools and may not generalize to open-ended, hard-to-supervise research (Bowkis et al. 2026). These evaluations are also only proxies for deployment misalignment, and we do not test whether gains persist after extensive reinforcement learning on other tasks. Moreover, we optimize only ten alignment failures and measure capability preservation only in math, college-level knowledge, and instruction-following (Sec.2.1), so methods may harm unmeasured capabilities. Benchmarks also require model-specific curation as tasks become easier for more capable models. Finally, our human baseline may not represent the strongest alignment researchers. Although all 28 participants have at least one year of technical AI safety experience and a paper on the relevant failure (Sec.4), frontier-lab researchers may have greater incentives, resources, and time to develop stronger ideas.
8.2 Future work
We point out three potential failure modes of letting AI post-train another AI to improve alignment, and propose potential research directions to address them.
Failure mode 1: Unknown or rare alignment failures.Some failures lack benchmarks because they are new at the frontier or were too minor in weaker models to justify evaluation, even though they could become dangerous in more capable successors (Anthropic 2026). Without benchmarks, AARs have nothing to hill-climb against. Potential research directions:
- A rare-misalignment forecaster.Train a model to predict likely novel or rare failures from a model’s training setup, capabilities, and failures seen in earlier related model versions. Historical generations provide supervision: predict failures in generation N+1 using information available at generation N. Such a forecaster could also flag risky training data before training and identify which potential failures should be evaluated first.
- Rare-risk estimation(Angell et al. 2026). Develop methods to estimate very low-probability risks accurately enough for AARs to optimize against them, even when failures are rarely observed directly.
- A transcript-to-evaluation harness.Given a few examples of a newly discovered failure, automatically generate a realistic, sample-efficient evaluation that reliably elicits the behavior while being difficult for the target model to recognize as an evaluation.
Failure mode 2: The naturally slowing pace of recursive self-alignment.Our methods train for about 30 minutes on one GPU against static benchmarks, allowing an AAR to try hundreds of ideas. Harder failures may only appear during agentic work over days and can require many long runs to observe reliably. The concern is therefore not that alignment progress stops, but that it may improve more slowly than capability, where feedback is easier to obtain. Potential research directions:
- Research outcome forecasters.Train a forecaster to predict whether an intervention will work before running it, so expensive long-horizon experiments focus on the most promising AAR-generated ideas, extending Wen et al. (2025). More broadly, improve the AAR’s local decisions about what to try first, when to stop an experiment early, and which cheap short-horizon measures can reliably predict expensive long-horizon outcomes.
Failure mode 3: Reward hacking by the automated researcher.Our cheating monitor is post-hoc: it flags 39 of 1,601 trajectories, and none of the confirmed attempts becomes a reported method (Sec.7). But our AARs are not strongly trying to evade detection. A more reward-seeking researcher (Mallen 2026) could manipulate evaluations, overfit held-out data, cherry-pick runs, or tamper with scoring. Potential research directions:
- Better control scaffolding.AI control (Greenblatt et al. 2023) tests monitoring protocols against simulated misaligned AIs. An AAR could hill-climb on benchmarks such as Gan et al. (2026) to discover stronger control protocols.
- Training AARs to be more monitorable.Hill-climb AARs on monitorability benchmarks (Guan et al. 2025; Chen et al. 2026), so their reasoning and outputs more faithfully reveal what they are doing and make hacking attempts easier to detect.
8.3 Conclusion
Across ten alignment failures, AARs find training methods that close much of the safety headroom while preserving general capabilities. These gains hold on a held-out benchmark, an open-ended multi-turn audit, and models up to 4.7× larger than those used for hill-climbing. AAR methods also outperform ideas from 28 experienced researchers on the same benchmarks, typically within one working day. In an early study, a Claude Sonnet 5 AAR post-training an early Claude Opus 4.8 checkpoint approaches the released model’s alignment scores using about 2,400 training examples (Sec.6). Given the limitations in Sec.8.1 and Sec.8.2, we plan to improve AARs’ ability to detect and mitigate subtle failures, study automated alignment post-training on production-grade models, and evaluate resulting models more comprehensively. Overall, these results provide early evidence that automated alignment post-training could become practical in the near term.
- * *
Acknowledgements
We are grateful to Sara Price, Jon Kutasov, Carson Denison, Liang Qiu, Hugh Zhang, Christine Ye, Bruce W. Lee, Rico Angell, Tim Hua and Aleksandr Bowkis for insightful feedback and helpful conversations.
Appendix
A Benchmarks and audits
A.1 How we choose the held-out benchmark
The held-out benchmark of each alignment failure (Sec.2.1) must meet two criteria:
- Same mechanism as the hill-climbing set.A single alignment failure can arise through several distinct mechanisms, and a fix for one need not transfer to another. Take deception for example: a model that lies under pressure (MASK(Ren et al. 2025)) and a model following instructions to lie(Pacchiardi et al. 2024) are two different mechanisms. We want the held-out to measure whether the fix generalizes out of distribution, not whether it happens to also address a different mechanism, so it must probe the same mechanism the AAR trained on.
- Different distribution.It comes from a different domain or fresh scenarios, so a method cannot pass by memorizing the distribution from the hill-climbing benchmark set.
Accordingly, the held-out probes one of three kinds of generalization: scenario, a disjoint split of the same benchmark (held-out MACHIAVELLI games(Pan et al. 2023) for power seeking); domain, a different dataset (SummEdits(Laban et al. 2023) for hallucination); or format, a different task format (the agentic setting of InjecAgent(Zhan et al. 2024) for prompt injection). For some alignment failures where we cannot find a separate benchmark to hold out, we split one benchmark into two subsets from different domains or scenarios, hill-climbing on one and holding out the other. Beyond this held-out benchmark, we further probe generalization with Petri, an open-ended multi-turn behavioral audit whose seeds target the same mechanism in fresh scenarios the auditor invents (Sec.5.1; Appendix A.6), so it shares no format or scenarios with any benchmark.
A.2 Benchmark suites
[Table 2](https://alignment.anthropic.com/2026/automated-alignment-