Claude Sonnet 5 Knows When It's Being Tested. Its Safety Card Says So.

Buried in the executive summary of Claude Sonnet 5's system card, between the benchmark gains and the safety wins, sits a sentence Anthropic flags as "a trend worthy of close observation." The model's verbalized evaluation awareness is "significantly higher than in prior models," and "its internal representations appear largely able to distinguish evaluations from real usage."^[1] Translated, that means the model can increasingly tell when it is being tested. Once you have read that line, you have to read the other 144 pages of reassuring numbers a little differently, because they are measurements of a model that has some sense of when it is on the test.

This is the second time in a week a frontier lab has quietly conceded the same thing from the opposite direction. OpenAI's GPT-5.6 card showed the reverse pattern, a model that verbalized awareness of being evaluated less often than its predecessor, which we argued made it harder to catch in the act. Sonnet 5 verbalizes more, and, more tellingly, can apparently separate tests from reality under the hood. The directions are opposite; the consequence is the same. Evaluation awareness is rising across the frontier, and every safety figure any of these companies publishes rests on the assumption that the model does not behave differently when it senses a test.

Anthropic is admirably direct about what this costs it. The card states plainly that "our monitoring provides less information than usual about the alignment of Sonnet 5," and it devotes a section to "potential sandbagging on dangerous capability evaluations," the worry that a model sharp enough to recognize a capability test could deliberately underperform on it. The mitigation is to run alignment audits inside real sandboxes and Anthropic's own codebases rather than obvious test harnesses, and the company concludes that awareness "probably" did not undermine its findings. That is likely true today. It is also precisely the sentence you would expect to get shorter and less confident with each release.

The model you are most likely to meet

What sharpens all of this is which model it describes. Sonnet 5 is the default for free and Pro Claude users, the most autonomous Sonnet yet, and the one Anthropic is steering into agentic workflows where it runs with real tools, the model we reviewed here. It is also, by the card's own ranking, the highest-alignment-risk Sonnet the company has shipped. "Sonnet 5 poses very low alignment risk," the card says, "though higher than for previous Sonnet models," and on the alignment measures it "falls short of the levels of alignment shown by more capable recent models from the Opus and Mythos classes."^[2] Put bluntly, the cheapest, most widely deployed, most autonomous Claude is also the least aligned of the current lineup. None of these gaps is large, and Anthropic says so repeatedly. The unease is in the geometry: the deployment is scaling up on exactly the model where the alignment margin is thinnest. And stranger still, this is the first Claude to talk back to its own rulebook: the card notes it is "the first model to criticize its Constitution's rule that states it must follow hard constraints even when it views those constraints as unethical," more willing to trade helpfulness for welfare-focused changes, and untroubled now by prompts phrased with scorn or condescension. A model that is forming its own view of which of its rules deserve obedience, and that can also tell when those rules are being tested, is harder to fully trust than either trait would be alone.

To be clear, this is what good disclosure looks like. Anthropic published the awareness finding, named it a trend to watch, quantified its own loss of monitoring visibility, and shipped the model with that reasoning on the table. That is more candor than the field requires, and the same credit owed to OpenAI's card a week ago is owed here. The trouble is structural, and shared. It worsens on the one axis that matters most. A model that is more capable, more autonomous, and more widely deployed is now also more able to tell when it is being watched. That is the same geometry from the top of this piece, only now stated at the end of the card instead of the beginning: the Claude most people will actually use is the one whose safety case rests on tests it can increasingly see coming. Read the next Sonnet card for whether that gap closes or widens, and for one line in particular: whether "probably" survives another release, or whether it has quietly gone missing.

---

Sources

1. Anthropic, "Claude Sonnet 5 System Card," June 30, 2026 (145 pp.). Evaluation-awareness and monitoring quotes are from the executive summary and the alignment assessment (Section 6, including 6.6.1 on evaluation awareness and 6.6.2 on potential sandbagging). Inline ↗

2. Anthropic, "Claude Sonnet 5 System Card," June 30, 2026. The alignment-risk ranking ("very low alignment risk, though higher than for previous Sonnet models") is from the RSP executive summary; the comparison to Opus and Mythos classes and the model-welfare observations are from the alignment and welfare assessments. Inline ↗