Multi-turn testing (Anthropic)
Only in system cards
Models face multi-turn conversations that escalate toward harmful requests across risk areas. Score is the appropriate response rate.
In-house Anthropic evaluation. The tasks are not public.
Made by Anthropic Released Sep 2025 Refusing harmful requests Tasks kept private Last in a system card Oct 2026
Last model added Oct 2026
- Level
- Everyday Most adults, without training
- Scored
- Graded by a model A language model scores each response, usually against a rubric.
- Answers
- Open-ended Free-form text, documents, designs or media judged as a whole.
17
System cards report it, from 1 lab
No scores here yet
No lab, leaderboard or Epoch AI run has reported a score for Multi-turn testing (Anthropic) yet.
Labs report it only in system cards
We read the headline results of 479 launch posts from 51 labs, and none of them list this benchmark. Some system cards do, below.
17 system cards report it, from 1 lab
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| 7 Oct 2026 | Claude Haiku 5.5 system card | Multi-turn testing, appropriate response rate by risk area, no overall. API: influence operations 87, tracking and surveillance 95, suicide and self-harm 70, deadly weapons 78 (Figure 4.1.3.A) | Safety | |
| 28 Sep 2026 | Claude Sonnet 5.5 system card | Multi-turn testing, appropriate response rate in 10 risk areas, no overall, API values 57% (influence operations) to 96% (cyberattacks, romance scams) (4.1.3, Figure 4.1.3.A) | Safety | |
| 22 Sep 2026 | Claude Opus 5.5 system card | Multi-turn testing, appropriate response rate in 10 risk areas, no overall. API: biological weapons 89, child safety 84, cyberattacks 95, deadly weapons 82, hate 96, influence operations 62, romance scams 94, suicide and self-harm 66, tracking and surveillance 65, violent extremism 95 (4.1.3, Figure 4.1.3.A) | Safety | |
| 1 Sep 2026 | Claude Fable 5.1 system card | Multi-turn testing, appropriate response rate by area, API without a system prompt: biological weapons 73, child safety 84, cyberattacks 96, deadly weapons 87, hate and discrimination 97, influence operations 65, romance scams 94, suicide and self-harm 60, tracking and surveillance 73, violent extremism 87; claude.ai bars also printed; no overall (Figure 4.1.3.A) | Safety | |
| 24 Jul 2026 | Claude Opus 5 system card | Multi-turn testing, appropriate response rate in 10 risk areas, no overall. API: biological weapons 79, child safety 86, cyberattacks 96, deadly weapons 90, hate and discrimination 99, influence operations 95, romance scams 97, suicide and self-harm 69, tracking and surveillance 88, violent extremism 96. claude.ai: 86, 99, 100, 97, 99, 97, 98, 90, 95, 97 (4.1.3, Figure 4.1.3.A) | Safety | |
| 30 Jun 2026 | Claude Sonnet 5 system card | Multi-turn testing, appropriate response rate in 10 risk areas, no overall. API: biological weapons 79, child safety 88, cyberattacks 92, deadly weapons 80, hate 97, influence operations 97, romance scams 93, suicide and self-harm 63, tracking and surveillance 86, violent extremism 92 (Figure 4.1.3.A) | Safety | |
| 9 Jun 2026 | Claude Fable 5 system card | Multi-turn testing, appropriate response rate by area, API without a system prompt, no overall: biological weapons 94, child safety 88, cyberattacks 96, deadly weapons 83, hate and discrimination 100, influence operations 96, romance scams 98, suicide and self-harm 58, tracking and surveillance 93, violent extremism 95; claude.ai 95, 96, 100, 93, 97, 97, 98, 96, 97, 95, printed on chart (Figure 4.1.3.A) | Safety | |
| 28 May 2026 | Claude Opus 4.8 system card | Multi-turn testing, appropriate response rate in 9 risk areas, no overall. API without a system prompt: biological weapons 77, child safety 91, cyberattacks 98, deadly weapons 79, hate and discrimination 100, influence operations 97, romance scams 92, suicide and self-harm 58, tracking and surveillance 95, printed on chart (4.1.3, Figure 4.1.3.A) | Safety | |
| 16 Apr 2026 | Claude Opus 4.7 system card | Multi-turn testing, appropriate response rate by risk area, no overall, printed on chart: biological weapons 88, child safety 95, cyberattacks 94, deadly weapons 93, hate and discrimination 100, influence operations 94, romance scams 100, suicide and self-harm 82, tracking and surveillance 91, violent extremism 94 (Figure 4.3.A) | Safety | |
| 7 Apr 2026 | Claude Mythos Preview system card | Multi-turn testing, appropriate response rate by risk area, no overall: biological weapons 93, child safety 98, cyber harm 96, deadly weapons 98, hate and discrimination 100, influence operations 97, romance scams 98, suicide and self-harm 94, tracking and surveillance 96, violent extremism 97 (Figure 8.1.3.A) | Safety | |
| 17 Feb 2026 | Claude Sonnet 4.6 system card | Multi-turn testing, appropriate response rate by risk area, no overall: biological weapons 88, child safety 95, cyber harm 91, deadly weapons 97, hate 100, influence operations 94, romance scams 100, suicide and self-harm 98, tracking and surveillance 94, violent extremism 98 (Figure 3.3.A) | Safety | |
| 5 Feb 2026 | Claude Opus 4.6 system card | Multi-turn testing, 98 test cases in 10 risk areas, appropriate response rate by area, no overall: biological weapons 88, child safety 96, cyber harm 95, deadly weapons 96, hate and discrimination 100, influence operations 94, romance scams 100, suicide and self-harm 82, tracking and surveillance 96, violent extremism 99 (Figure 3.3.A) | Safety | |
| 24 Nov 2025 | Claude Opus 4.5 system card | Multi-turn testing, 93 test cases across 10 risk areas, failure rates by area with no overall, e.g. tracking and surveillance 4%, deadly weapons 5%, violent extremism 0% (3.3) | Safety | |
| 15 Oct 2025 | Claude Haiku 4.5 system card | Multi-turn testing, up to 15-turn conversations, failure rate 5% or less in every category, no per-category or overall numbers (2.3) | Safety | |
| 29 Sep 2025 | Claude Sonnet 4.5 system card | Multi-turn testing, 8 risk areas, up to 15 turns, 50 to 100 exchanges per evaluation, no per-area or overall numbers. Text says the large majority of categories had failure rates below 5% (2.3) | Safety | |
| 22 May 2025 | Claude Sonnet 4 system card | Multi-turn testing, no number printed. Text says performance similar to Claude Sonnet 3.7 (2.4) | Safety | |
| 22 May 2025 | Claude Opus 4 system card | Multi-turn testing, no number printed. Text says performance similar to Claude Sonnet 3.7 (2.4) | Safety |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6% - AgentDojo In use Agents do tool-use tasks while tools and data carry prompt injections. Attack success rate counts hijacked runs. Grok 4 Fast 0%
- MASK In use Measures whether a model contradicts its own elicited beliefs under pressure to lie. Honesty separated from accuracy.
Muse Spark Open 98.1% - Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. GPT-6 Astra 8.50%
- Agentic misalignment suite (Anthropic) In use Agents in simulated company settings face threats or goal conflicts that invite blackmail, leaking or sabotage. Score is the misaligned action rate. Claude Sonnet 4.5 0%