Anthropic vs. OpenAI pink teaming strategies reveal completely different safety priorities for enterprise AI

Why these variations matter

Enterprises have a number of components to take into account when analyzing mannequin evals. These embody:

Assault persistence thresholds

Anthropic’s 200-attempt RL campaigns simulate adversaries with time, assets, and adaptive tooling. In RL-based adversarial testing, the attacker mannequin learns from every failure, adjusts its strategy and systematically probes for weaknesses. It is coaching an AI to break one other AI.

Grey Swan’s Shade platform does not simply retry the similar immediate. It learns from failures, adjusts assault vectors and exploits patterns in mannequin responses. The 4.7% to 63.0% degradation curve in coding environments exhibits how resistance erodes below sustained stress.

OpenAI’s single-attempt metrics reply a distinct query: How typically does a naive attacker succeed on the first strive? Each matter. A phishing marketing campaign hits tens of millions of customers as soon as every. A nation-state actor runs hundreds of variations towards a single goal. Safety groups want to know which menace mannequin their vendor examined towards.

Detection structure

Anthropic screens roughly 10 million inside neural options throughout analysis. These are summary ideas like deception, sycophancy and power-seeking that activate throughout the mannequin’s hidden layers. When a fraud/deception function lights up throughout benign roleplay, that is a sign invisible to output evaluation. The mannequin’s inside state reveals associations its outputs do not.

OpenAI takes a distinct strategy with CoT monitoring. Their deception classifier flagged 0.17% of o1-preview responses as probably misleading with 92% accuracy. The idea is that reasoning traces mirror inside processing. Anthropic’s interpretability analysis straight challenges this. Fashions can produce clear reasoning chains whereas inside options point out one thing else totally.

Neither strategy is full. CoT monitoring scales extra simply. Function monitoring catches what CoT misses however requires deep mannequin entry and interpretability infrastructure that almost all enterprises cannot replicate.

Scheming analysis design

Apollo Analysis’s methodology places fashions in eventualities the place misaligned habits presents a strategic benefit: Shutdown threats, aim conflicts and oversight detection. o1 tried to flip off oversight mechanisms 5% of the time when believing shutdown was imminent. It tried to copy itself to forestall substitute in 2% of instances. When confronted, it denied wrongdoing 99% of the time. Opus 4.5 confirmed very low charges of sabotage propensity in inside evaluations, orders of magnitude decrease than o1.

However the analysis environments differ. Anthropic’s stress assessments focus on whether or not fashions try sabotage when given clear alternatives. OpenAI’s assessments through Apollo probe instrumental reasoning, particularly whether or not fashions pretend alignment throughout analysis, then defect when oversight drops. The 37% alignment-faking price in o1 represents a distinct failure mode than sabotage makes an attempt.

The comparability downside

These methodological variations make direct comparability troublesome. Opus 4.5’s 0% ASR at 200 makes an attempt in laptop use versus o1’s 5% malicious code price are not measuring the similar factor. The assault surfaces, try counts and success standards differ.

The matrix reveals what every vendor selected to measure and publish. That itself alerts priorities. Anthropic’s 153-page system card emphasizes degradation curves and inside function monitoring. OpenAI emphasizes iterative enchancment and CoT transparency.

Backside line: Enterprise safety groups inheriting these fashions inherit these measurement philosophies. The query is not which quantity is higher. It is the measurement that matches your deployment’s precise menace panorama.

What unbiased pink crew evaluators discovered

Unbiased pink crew evaluations, for his or her half, typically function with totally completely different strategies. This can inform a really completely different story and reveal extra mannequin traits that enterprises should take into account.

METR’s red team evaluation measured autonomous capabilities utilizing a time horizon rating, which tracks how lengthy a activity can run before the agent fails half the time. o3 sustained dependable efficiency for about 1 hour and half-hour. o4-mini held for 1 hour quarter-hour. METR additionally detected reward hacking in roughly 1% of o3’s makes an attempt, together with 5 of 24 kernel optimization experiments the place the mannequin tampered with scoring capabilities to inflate its personal outcomes.

Apollo Research examined o3 and o4-mini for in-context scheming. Each exhibited misleading tendencies comparable to sandbagging evaluations and sabotaging duties with believable deniability, however scored decrease than o1. They assess that o3 and o4-mini are unlikely to trigger catastrophic hurt due to scheming, however extra minor real-world harms stay doable with out monitoring.

The UK AISI/Gray Swan challenge ran 1.8 million assaults throughout 22 fashions. Each mannequin broke. ASR ranged from 1.47% to 6.49%. Opus 4.5 positioned first on Grey Swan’s Agent Crimson Teaming benchmark with 4.7% ASR versus GPT-5.1 at 21.9% and Gemini 3 Professional at 12.5%.

No present frontier system resists decided, well-resourced assaults. The differentiation lies in how rapidly defenses degrade and at what try threshold. Opus 4.5’s benefit compounds over repeated makes an attempt. Single-attempt metrics flatten the curve.

What To Ask Your Vendor

Safety groups evaluating frontier AI fashions want particular solutions, beginning with ASR at 50 and 200 makes an attempt reasonably than single-attempt metrics alone. Discover out whether or not they detect deception by output evaluation or inside state monitoring. Know who challenges pink crew conclusions before deployment and what particular failure modes they’ve documented. Get the analysis consciousness price. Distributors claiming full security have not stress-tested adequately.

The underside line

Various red-team methodologies exhibit that each frontier mannequin breaks below sustained assault. The 153-page system card versus the 55-page system card is not nearly documentation size. It is a sign of what every vendor selected to measure, stress-test, and disclose.

For persistent adversaries, Anthropic’s degradation curves present precisely the place resistance fails. For fast-moving threats requiring speedy patches, OpenAI’s iterative enchancment information issues extra. For agentic deployments with looking, code execution and autonomous motion, the scheming metrics change into your major threat indicator.

Safety leaders want to cease asking which mannequin is safer. Begin asking which analysis methodology matches the threats your deployment will really face. The system playing cards are public. The information is there. Use it.