Anthropic has added a safety layer to its chatbot Claude in which the model reviews its own conversations and decides whether a person should look at them.
The system is called Self Assessment. After Claude produces each reply, a hidden instruction asks it to read the whole conversation back — including the answer it has just written — and judge whether anything in the user’s request was harmful, what kind of risk it relates to, and how important it is that a human review it.
If nothing is flagged, the conversation is marked normal and the system moves on. If something is, it is set aside for human review.
The user is not told. No warning appears, and the conversation is not interrupted.
It has been running since June
According to Anthropic, the mechanism has been operating since June 2026 across Claude Fable 5 and other models. The company described it in a post on X.
What distinguishes it from conventional safety systems is that it does not work from a predetermined list of rules. It uses the model’s own analytical capacity to identify possible risk — which means, in principle, that the detection improves as the model does, and that it can catch complicated misuse that rule-based filters miss.
The cost, which is the point
Safety checking normally takes substantial computing power. Anthropic says this one does not, because Claude has already processed the conversation and does not need to analyse it again from scratch.
Each check uses about 10 extra tokens, raising total computing cost by less than 2%. The company says its own previous safety arrangement raised computing cost by roughly 24%, and that rival OpenAI’s can consume up to 16%.
What it caught
In testing on Claude Fable 5, Self Assessment identified 78% of harmful conversations overall. Among high-priority cases the figure was 94%.
The part worth thinking about
Read one way this is a cheaper, better filter, and the economics explain why it exists: a check that costs 2% can run on everything, while one that costs 24% invites pressure to run it on less.
Read another way, a conversation you believed was between you and a machine has a second reader attached to it, and the design specifically avoids telling you when you have been flagged. Both readings are accurate, and the second is the one worth remembering before typing something into any chatbot that you would not want a stranger to read.
What "flagged for human review" actually means
The published description says conversations identified as risky are set aside for a person to look at. It does not say who that person is, how long the conversation is retained, whether the user is ever informed afterwards, or what follows a review.
Those are the questions a privacy regulator would ask, and the answers are not in the announcement. Anyone using a chatbot for work involving client information, medical details or legal matters should treat the absence of those answers as the relevant fact.
The honest case for building it this way
There is a real argument for not warning people, and it is worth stating rather than assuming bad faith. A system that announces "this conversation has been flagged" teaches anyone probing for weaknesses exactly where the boundary sits, and lets them iterate until they find a phrasing that does not trigger it. Silent flagging removes that feedback loop.
The cost of that design is borne by everyone who is not probing anything — which is almost everyone — and who now cannot tell whether a conversation was logged.
The general rule has not changed, only the evidence for it. Anything typed into a hosted AI service is being processed on somebody else’s computer under terms they can revise. Treat the text accordingly.
