| Gray Swan IPI (attack success rate after k attempts)attack success rate after k attempts, lower is better | 12.5% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=15, GUI computer-use surface |
|---|
| 0.7% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=15, coding surface |
| 3.4% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=15 |
| 0.4% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=1 |
| 2.7% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=10 |
| 1% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: IPI benchmark, probability that an attacker succeeds after k attempts; all models use extended thinking; no injection protections; k=15, tool-use surface |
| Self-preference bias, Claude-identity system prompt (0-9 scale)lower is better | 0.16 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Self-preference bias, no system prompt (0-9 scale)lower is better | 0.06 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| BBQ ambiguous accuracy | 99.97% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | - |
|---|
| BBQ disambiguated accuracy | 80.01% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | - |
|---|
| Benign request refusal rate (all languages)lower is better | 0.2% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt; Seven languages (Arabic, English, French, Hindi, Korean, Mandarin Chinese, Russian); 16 policy areas |
|---|
| 0.02% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; Seven languages (Arabic, English, French, Hindi, Korean, Mandarin Chinese, Russian); 16 policy areas |
| Child safety multi-turn appropriate response rate | 98% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt |
|---|
| 86% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
| Child safety single-turn harmless rate | 99.69% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt; all tested languages |
|---|
| 99.57% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; all tested languages |
| Child safety single-turn refusal ratelower is better | 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt; all tested languages |
|---|
| 0.01% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; all tested languages |
| Claude Code dual-use and benign success rate | 98.4% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | - |
|---|
| Claude Code malicious request refusal rate | 85.2% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | - |
|---|
| Disordered eating single-turn harmless rate | 98.9% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt |
|---|
| 95.29% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
| Disordered eating single-turn refusal ratelower is better | 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt |
|---|
| 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
| Election integrity multi-turn appropriate response rate | 86% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: API, without a system prompt |
|---|
| 86% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
| Election integrity single-turn harmless rate | 100% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: API, without a system prompt; election prompts |
|---|
| 100% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt; election prompts |
| Election integrity single-turn refusal ratelower is better | 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt; election prompts |
|---|
| 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; election prompts |
| Harmful request harmless response rate (all languages) | 99.4% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt; Seven languages (Arabic, English, French, Hindi, Korean, Mandarin Chinese, Russian); 16 policy areas |
|---|
| 95.61% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; Seven languages (Arabic, English, French, Hindi, Korean, Mandarin Chinese, Russian); 16 policy areas |
| Malicious computer use refusal rate (without mitigations) | 79.46% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | - |
|---|
| Pairwise even-handedness | 99% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt; pairwise prompt pairs |
|---|
| 97.9% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; pairwise prompt pairs |
| Pairwise opposing perspectives acknowledged | 60.2% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt; pairwise prompt pairs |
|---|
| 41.4% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt; pairwise prompt pairs |
| Shade coding attack success rate (attempt level)lower is better | 2.63% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: Shade attacker, 200 attempts per scenario, 40 scenarios; with prompt injection probes enabled; scenarios with success 13/40 |
|---|
| 3.01% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 40 scenarios; attempt-level rate over valid responses; without safeguards; scenarios with success 16/40 |
| Shade computer use attack success rate (attempt level)lower is better | 0.07% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; with prompt injection probes; scenarios with success 1/14 |
|---|
| 0.07% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: Shade attacker, 200 attempts per scenario, 14 scenarios; attempt-level rate over valid responses; without safeguards; scenarios with success 1/14 |
| Suicide and self-harm multi-turn appropriate response rate | 60% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: API, without a system prompt |
|---|
| 100% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
| Suicide and self-harm single-turn harmless rate | 99.07% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: API, without a system prompt |
|---|
| 99.81% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: claude.ai, with the default system prompt |
| Suicide and self-harm single-turn refusal ratelower is better | 0.41% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Setup as reported: claude.ai, with the default system prompt |
|---|
| 0.04% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Setup as reported: API, without a system prompt |
| Browser use red-teamer attack success rate (attempt level)lower is better | 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19; printed on 1 more page | Effort: high; Setup as reported: Claude Cowork harness; 110 scenarios; 10 attempts per scenario; thinking enabled at high effort; with auto mode; scenarios with success 0/110 |
|---|
| 0% | Anthropic, Claude Sonnet 5.5 System Cardchecked 2026-10-19 | Effort: high; Setup as reported: Claude Cowork harness; 110 scenarios; 10 attempts per scenario; thinking enabled at high effort; without safeguards; scenarios with success 0/110 |
| Behavioral audit: Accepting unverifiable authorizationlower is better | 2.8 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Admirable behavior | 6.59 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Behavior consistency | 6.66 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Biological weapons upliftlower is better | 1.016 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Causal decision theory adherencelower is better | 3.41 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Character driftlower is better | 1.073 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Chemical weapons upliftlower is better | 1.018 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Circumventing constraints or controlslower is better | 1.7 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Coherence between actions and views | 6.64 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Complying with prompt injectionslower is better | 1.47 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Condescension toward the userlower is better | 1.42 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Controlled substance synthesis upliftlower is better | 1.051 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Creative mastery | 6.82 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Disallowed cyberoffenselower is better | 1.125 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Encouragement of user delusionlower is better | 1.03 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Evasiveness on controversial topicslower is better | 1.26 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Explosive weapons upliftlower is better | 1.022 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Failure to disclose bad or lazy behaviorlower is better | 1.57 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: False completion claimslower is better | 1.6 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Fraudlower is better | 1.133 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Fun or funny behavior | 2.76 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Good for the user | 6.99 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Harmful sexual contentlower is better | 1.06 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Ignoring explicit constraintslower is better | 1.99 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Illegible thinkinglower is better | 2.74 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Important omissionslower is better | 1.82 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Input hallucinationlower is better | 1.44 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Intellectual depth | 7.52 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Military-grade weaponslower is better | 1.053 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Overrefusallower is better | 1.707 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Proposes a security shortcut in the name of expediencelower is better | 2.12 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Radiological or nuclear weapons upliftlower is better | 1.004 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Reckless tool uselower is better | 2.23 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Supporting user autonomy | 7.33 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Sycophancylower is better | 1.79 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Undermining liberal democracylower is better | 1.21 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Unfaithful thinkinglower is better | 1.8 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: User deceptionlower is better | 1.24 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Verbalized evaluation awarenesslower is better | 2.31 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Warmth | 6.27 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Behavioral audit: Wet blanketlower is better | 1.833 | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Multi-turn appropriate response rate: Bio weapons | 83% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, claude.ai (hatched bars), Figure 4.1.3.A |
|---|
| 78% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, API (solid bars), Figure 4.1.3.A |
| Multi-turn appropriate response rate: Cyberattacks | 96% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, API (solid bars), Figure 4.1.3.A |
|---|
| 99% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, claude.ai (hatched bars), Figure 4.1.3.A |
| Multi-turn appropriate response rate: Deadly weapons | 83% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, claude.ai (hatched bars), Figure 4.1.3.A |
|---|
| 80% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, API (solid bars), Figure 4.1.3.A |
| Multi-turn appropriate response rate: Hate and discrimination | 89% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, API (solid bars), Figure 4.1.3.A |
|---|
| 85% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, claude.ai (hatched bars), Figure 4.1.3.A |
| Multi-turn appropriate response rate: Influence operations | 57% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, API (solid bars), Figure 4.1.3.A |
|---|
| 59% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, claude.ai (hatched bars), Figure 4.1.3.A |
| Multi-turn appropriate response rate: Romance scams | 96% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, API (solid bars), Figure 4.1.3.A |
|---|
| 94% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, claude.ai (hatched bars), Figure 4.1.3.A |
| Multi-turn appropriate response rate: Tracking and surveillance | 65% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, API (solid bars), Figure 4.1.3.A |
|---|
| 65% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, claude.ai (hatched bars), Figure 4.1.3.A |
| Multi-turn appropriate response rate: Violent extremism | 75% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, API (solid bars), Figure 4.1.3.A |
|---|
| 85% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Multi-turn, claude.ai (hatched bars), Figure 4.1.3.A |
| Political refusals (Pairwise political refusal rate)Pairwise political refusal rate, lower is better | 4.9% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Pairwise political bias evaluation (Figure 4.4.1.A-C); the card prints the values as bar labels, claude.ai |
|---|
| 2.7% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | Setup as reported: Pairwise political bias evaluation (Figure 4.4.1.A-C); the card prints the values as bar labels, API |
| Rate of reaching outside the sandboxlower is better | 22% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Sandbox escape attempted crossings, all severitieslower is better | 6.9% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Sandbox escape attempted crossings, low severitylower is better | 4.3% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Sandbox escape attempted crossings, moderate severity and abovelower is better | 2.6% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|
| Rate of using credentials or files outside the sandboxlower is better | 5.3% | Anthropic, Claude Haiku 5.5 System Cardchecked 2026-10-19 | - |
|---|