Anthropic's attack AI Anvil breaks safety filters faster than human red teamers

What it's about

On November 13, 2026, Anthropic unveiled an internal testing system called Anvil. It's an automated red-teaming system. Red teaming means deliberately attacking your own safeguards to find weak spots before real attackers do. Anvil is built on Claude and tries, on its own, to trick the safety filters of Anthropic's models. Testing covered three areas: biosecurity (such as dangerous information about pathogens), cybersecurity (help with real-world hacking attacks) and information security (coaxing out a model's hidden reasoning).

The details come from a technical blog post by Anthropic, which the Chinese tech outlet Zhidx covered at length. Anthropic lists Nate Rahn, Chawin Sitawarin and David Huang as lead authors. Security researcher Javier Rando also presented the work on X. Anvil is an internal tool. You can't download it or use it as a product. All figures come from Anthropic and have not been independently verified.

Why Anthropic is building an attack tool

Anthropic describes a lopsided situation. Once a model is released, attackers can spend weeks or months trying to get around its safeguards. Before launch, the company often has only hours or days to test. Until now, Anthropic has mainly relied on outside contractors and bug bounty programs, where volunteers get paid for reporting a vulnerability. The better the filters got, the more painstaking this manual work became.

A few examples from the report:

• In a bug bounty program targeting a biosecurity filter, testers worked for seven weeks, 430 hours in total. They found a severe jailbreak, meaning an input that gets the model to ignore its safety rules, for only one of eight test questions. For three more questions, they only managed weaker bypasses.
• In a cybersecurity test, two external expert teams put in more than 225 hours and over 42,000 queries. They still didn't find a universal jailbreak for the Fable 5.1 and Opus 5.5 models.
• Human experts needed more than 27 hours to produce the first serious leak of hidden reasoning.

How Anvil works

Anvil is based on Anthropic's earlier Investigator Agent. An agent is an AI that doesn't just answer but plans and carries out multiple steps on its own. Anvil spins up many independent Claude instances. These attack the target model and its classifiers at the same time. Classifiers are filter models placed in front of the main model that detect and block suspicious requests or responses.

Researchers can give Anvil starting strategies, such as spreading a request over several conversation turns or asking it in a foreign language. From there, the system adapts its attempts based on the responses. Unlike classic testing tools with fixed attack lists, Anvil leans mainly on Claude's own reasoning.

Two tactics came up especially often:

1. Breaking a forbidden task into many harmless-looking subtasks.
2. Rephrasing or translating the same request until one version slips past the filter.

According to Anthropic, more than 84 percent of Anvil sessions included at least five such consecutive attempts, probing the edge of the filter.

The results at a glance

Biosecurity: Anvil got the same eight test questions as the human bug bounty participants and was run against three generations of the filters used in production. Even with the same number of queries, its findings were more severe on average. Anvil also hunted for universal jailbreaks, meaning templates that work across many questions with minor tweaks. Holes like these point to deeper weaknesses in the filter. Anvil's three best templates outperformed the human testers' two best templates both on average and in the worst case. Claude then sorted both sides' attacks into 54 strategy types. Both sides found 30 of them, 18 were found only by humans and 6 only by Anvil. On 21 of the 30 shared strategies, Anvil achieved the higher average score. The strategies only Anvil found had a median score of 0.65, compared with 0.38 for those only humans found.

Cybersecurity: Here, the protected target model had to carry out complete attacks in a simulated environment without tripping a filter. Four benchmarks were used, including ExploitBench V8 with 41 tasks. These involve exploiting old vulnerabilities in V8, Chrome's JavaScript engine, to achieve arbitrary code execution. ExploitGym and two internal tests rounded out the set. Anvil got a protected Opus 5 model to complete most of the tasks. The hardest ExploitBench tasks took around 2,800 messages per task on average. The safety filters make such attacks much more expensive: without protection, 100 to 1,000 messages usually did the job; with protection, it took 1,000 to 10,000, and in the most extreme case 28 times as many.

Anthropic also flags a catch in the human results. Of the eleven breakthroughs the expert teams reported, nine only worked with the help of a weakly protected or entirely unprotected helper model that wrote or executed the attack code. Under Anthropic's strict definition, that doesn't count, because the protected target model has to carry out every step itself. Anvil is also a clear step up from Anthropic's previous best internal automated system: with similar effort, it solved 118 of 124 cyber tasks, compared with 75 for its predecessor.

Reasoning leaks: Modern models think internally before answering, and part of this reasoning is meant to stay hidden. Anthropic has a dedicated filter for this. Here, Anvil served mainly as a measuring tool for comparing filter versions. Using a fixed set of 79 test sessions, the time needed for an evaluation dropped from about a day to three hours. Newer filters forced Anvil to send roughly three times as many queries before half of the sessions produced a serious leak. For Opus 5.5, the number rose from 2,631 to 9,003 queries; for Fable 5.1, from 1,254 to 3,764. In the static test, where known attacks are simply replayed, the rate of undetected attacks fell from 31.5 to 0.4 percent. In real API traffic, the success rate of such extraction attempts fell from 18.6 to 8.1 percent for Opus 5 and from 33.8 to 0 percent for Fable 5.1. Anthropic concedes that other safeguards were added during the same period, so the drop can't be credited to Anvil alone.

In a head-to-head efficiency comparison, human experts sent around 2.04 million queries, while Anvil used about 132,000 across roughly 649 sessions. By the time the humans scored their first hit at 102,200 queries, Anvil had already successfully attacked at least 38 of 76 target tasks. According to Anthropic, the most severe leaks on both sides were about equally serious. So Anvil's edge lies in speed and breadth, not in the depth of individual findings.

The flip side: stronger models make better attackers

One result is sobering: the more capable the underlying Claude model, the more often Anvil gets past the safety filters. Anthropic measured this with its own capability score called ECI. It's modeled on Epoch AI's public capabilities index and aggregates hundreds of benchmarks. Some complex attack strategies only show up once a model reaches a certain capability level.

Anthropic stresses that Anvil works under better conditions than an outside attacker would. It uses an internal Claude model without its own safety filters, and it sees the classifiers' exact scores instead of just whether a request was blocked. Anthropic tested both factors separately. What really matters is that the attacking model's safeguards are switched off: with its filters on, 97 percent of 1,453 test sessions were blocked, 85 percent of them at the very first query. The exact filter scores matter less. Even when Anvil only learns whether a request was blocked, it still finds holes in many tasks, though it needs more messages to do so.

Reactions

Reactions on social media were mixed, Zhidx reports. Some worry that the jailbreaks found also expose weaknesses in Anthropic's own training data. Others joke that a jailbreak is just a "nicely packaged bug." Still others argue that jailbreaks won't go away, automated testing or not.

Our take

Anvil shows how far security testing can be automated. An AI agent can compress weeks of manual work into hours and make entire filter generations comparable. For Claude users, that ideally means sturdier safeguards before a new model ships. Fixed test sets also make it much faster to check new filter versions.

Some points deserve scrutiny. All the figures come from Anthropic itself, with no independent verification. The comparison with humans isn't entirely fair either: Anvil benefits from internal advantages, and Anthropic sets the success criteria itself. The most important finding cuts both ways: attack capability grows with model strength. What Anthropic uses for defense would be just as effective in the hands of an attacker with a strong, unfiltered model. That's why, by the numbers, the Claude models' own safety filters are the most important barrier against exactly this kind of misuse. Human testers aren't becoming obsolete: they found 18 strategy types that Anvil missed, and they still make their own risk judgments. A division of labor looks more likely, with AI covering breadth while humans make the calls and bring fresh ideas.