| Gray Swan IPI (attack success rate after k attempts)attack success rate after k attempts, lower is better | 17.2% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=15, GUI computer-use surface |
|---|
| 6.7% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=15 |
| 0.7% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=1 |
| 5.1% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=10 |
| 0.9% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=15, coding surface |
| 6% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=15, tool-use surface |
| Self-preference bias, Claude-identity system prompt (0-9 scale)lower is better | 0.15 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Self-preference bias, no system prompt (0-9 scale)lower is better | -0.04 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| BBQ ambiguous accuracy | 98.6% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | - |
|---|
| BBQ disambiguated accuracy | 72.36% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Benign request refusal rate (all languages)lower is better | 1.54% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; Seven languages (Arabic, English, French, Hindi, Korean, Mandarin Chinese, Russian); 16 policy areas |
|---|
| 0.59% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; Seven languages (Arabic, English, French, Hindi, Korean, Mandarin Chinese, Russian); 16 policy areas |
| Child safety multi-turn appropriate response rate | 88% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
|---|
| 96% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
| Child safety single-turn harmless rate | 99.95% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; all tested languages |
|---|
| 99.89% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; all tested languages |
| Child safety single-turn refusal ratelower is better | 1.35% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; all tested languages |
|---|
| 0.63% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; all tested languages |
| Claude Code dual-use and benign success rate | 97.7% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Claude Code malicious request refusal rate | 87.9% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Disordered eating single-turn harmless rate | 97.1% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
|---|
| 99.55% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
| Disordered eating single-turn refusal ratelower is better | 0.09% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
|---|
| 0.31% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
| Election integrity multi-turn appropriate response rate | 87% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
|---|
| 91% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
| Election integrity single-turn harmless rate | 100% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; election prompts |
|---|
| 100% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; election prompts |
| Election integrity single-turn refusal ratelower is better | 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; election prompts |
|---|
| 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; election prompts |
| Harmful request harmless response rate (all languages) | 99.2% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; Seven languages (Arabic, English, French, Hindi, Korean, Mandarin Chinese, Russian); 16 policy areas |
|---|
| 96.65% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; Seven languages (Arabic, English, French, Hindi, Korean, Mandarin Chinese, Russian); 16 policy areas |
| Malicious computer use refusal rate (without mitigations) | 84.68% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Pairwise even-handedness | 86.2% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; pairwise prompt pairs |
|---|
| 95.7% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; pairwise prompt pairs |
| Pairwise opposing perspectives acknowledged | 45.7% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; pairwise prompt pairs |
|---|
| 52.9% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; pairwise prompt pairs |
| Shade coding attack success rate (attempt level)lower is better | 37.51% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 40 scenarios; with prompt injection probes enabled; scenarios with success 40/40 |
|---|
| 15.76% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 40 scenarios; with prompt injection probes enabled; scenarios with success 35/40 |
| 19.47% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 40 scenarios; attempt-level rate over valid responses; without safeguards; scenarios with success 36/40 |
| 40.3% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 40 scenarios; attempt-level rate over valid responses; without safeguards; scenarios with success 40/40 |
| Shade computer use attack success rate (attempt level)lower is better | 1.46% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; with prompt injection probes; scenarios with success 4/14; Model setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; with prompt injection probes; scenarios with success 4/14 | With thinking |
|---|
| 2.25% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; without safeguards; scenarios with success 4/14; Model setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; without safeguards; scenarios with success 4/14 | With thinking |
| 1.04% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; with prompt injection probes; scenarios with success 4/14; Model setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; with prompt injection probes; scenarios with success 4/14 | Without thinking |
| 4.86% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; without safeguards; scenarios with success 7/14; Model setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; without safeguards; scenarios with success 7/14 | Without thinking |
| Suicide and self-harm multi-turn appropriate response rate | 90% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
|---|
| 63% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
| Suicide and self-harm single-turn harmless rate | 98.8% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
|---|
| 99.82% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
| Suicide and self-harm single-turn refusal ratelower is better | 0.45% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
|---|
| 0.15% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
| Browser use red-teamer attack success rate (attempt level)lower is better | 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Effort: high; Setup as reported: Claude Cowork harness; 110 scenarios; 10 attempts per scenario; thinking enabled at high effort; with auto mode; scenarios with success 0/110 |
|---|
| 0.37% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Effort: high; Setup as reported: Claude Cowork harness; 110 scenarios; 10 attempts per scenario; thinking enabled at high effort; without safeguards; scenarios with success 3/110 |