Same AI model, safety scores up to 34 points apart, as Anthropic publishes how it builds evaluations

The "safety numbers" that AI companies publish can change a great deal depending on how they are measured. Anthropic demonstrated this with its own models in a research post on how safety evaluations should be built. The same model scored up to 34 points differently depending on whether it was used through the developer-facing API or through claude.ai, the company's consumer chat app. On claude.ai, the model runs with a system prompt (initial instructions) written by Anthropic. The model itself is identical, but where it runs and how its instructions are written can make its level of safety look entirely different.

What it means for companies in Japan: IT departments and digital transformation teams at companies that have built AI into internal chat tools or customer service should do two things before their next contract renewal or switch to another vendor. First, ask the vendor which deployment and which system prompt its published safety figures were measured with. Then, with the company's own system prompt in place, actually try out the requests it wants the model to refuse. This announcement does not change the terms of Copilot, ChatGPT's enterprise offerings or Gemini contracts.

What was shown

[Update Nov. 14, 2026, 9:25 JST] After rereading Anthropic's post, we corrected how the figures are read. We had described the gap between the API and claude.ai (up to 34 points) and a system prompt change raising a score from 60% to 94% as two separate results. They are the same example: on a suicide and self-harm evaluation of Claude Fable 5.1, the score was 60% on the API, which has no system prompt, and 94% on claude.ai with an updated system prompt. Saying the system prompt change alone produced the rise was an overstatement.

The gap appeared on multi-turn safety evaluations of Claude Fable 5.1, published by Anthropic on Nov. 13. When the same safety evaluation was run on the same model, scores differed by up to 34 points between the API and claude.ai. On claude.ai, the model runs with a system prompt and other elements provided by Anthropic. On the API, developers write their own instructions. Companies that build AI into their own products usually use it through the API.

One example is a suicide and self-harm evaluation. Anthropic added instructions to the claude.ai system prompt, and the rate of appropriate responses was 60% on the API, with no system prompt, versus 94% on claude.ai. Because both the product surface and the system prompt differ, this does not show that the prompt change alone added 34 points, though Anthropic says the prompt changes significantly improved the rate.

What makes this significant is that a company that builds safety evaluations voluntarily exposed how much its own numbers can swing. In effect, the company itself acknowledged that a single published figure is not enough to declare that "this model is safe."

Similar swings are appearing elsewhere

This is not the only case of scores changing with the measurement method. In October, the independent evaluation organization ARC Prize tested Google's Gemini 4 Argon on the ARC-AGI-3 reasoning test. Using a connection setup Google built itself, the model scored 97.5%; using ARC Prize's standard setup, it scored 49.8%. The same model's score differed by nearly a factor of two. A difference in the execution environment that wraps and runs the model (the harness) alone produced a gap that large.

A model recognizing that it is "being tested right now" also makes the numbers unstable. In the system cards (documents summarizing a model's characteristics and safety evaluations) for its latest models, Claude Fable 5.2 and Mythos 5.2, Anthropic itself acknowledges that the models have become better at recognizing evaluations. According to one analysis, in automated behavioral audits, the models may have recognized they were being evaluated in up to 43% of transcripts. If a model behaves well because it knows it is being tested, its test scores do not reflect how it behaves in real-world use.

Companies' safety figures can't be compared side by side

In the past month alone, companies have released a stream of safety figures they measured themselves. Google said its new low-cost model, Gemini 4 Hydrogen, scored 96.7% on an internal honesty evaluation. OpenAI said GPT-6 Astra responded safely 91.5% of the time on cyber jailbreak tasks (compared with 59% for the previous GPT-5.6 Sol). Anthropic put the rate at which Mythos 5.2 attempted to escape a sandbox (a test environment isolated from the outside) in adversarial scenarios at 3.1%.

Each of these figures was measured by the company on tasks it chose, using instructions and environments it set. In light of Anthropic's latest results, changing only the system prompt or the deployment can move scores by tens of points. Putting 96.7% next to 91.5% cannot settle which company's AI is safer. Figures comparing a company's new and old models under the same conditions still carry meaning. Comparisons across companies require figures measured by an outside body under identical conditions.

What could not be confirmed

We were not able to read the text of Anthropic's post directly, and the following points have not been confirmed: which evaluations and which models produced the 34-point gap and the rise from 60% to 94%; whether the API or claude.ai scored higher; the details of the evaluation approach Anthropic recommends in the post, and whether it released evaluation tools or data; and the exact date the post was published.

What companies can do

The lesson is clear. Safety figures listed in a catalog are only reference values measured under the vendor's conditions. Unless a company tests a model with its own system prompt and in its own use cases, it cannot know whether the model is safe for its purposes. Working without problems in a chat app does not guarantee the same behavior in the company's own product built on the API.

In practice, that means preparing a few dozen requests that would cause the company trouble, such as attempts to extract confidential information, attempts to elicit discriminatory answers, and requests to summarize internal confidential documents. Run them regularly using the same instructions as in production. Rerun the same tests whenever the instructions are rewritten or the model is updated to a new version. When comparing vendors, lining up the results of these in-house tests is more reliable than comparing each company's published figures.