claude now writes a hidden safety check after every reply – anthropic says it costs under 2% of compute and catches 94% of the urgent cases a heavier classifier flags

what the research note by nine anthropic researchers adds:
- it gets better with size: recall rose from ~16% on the smallest model to ~96% on the largest
- a third of its flags fall outside the harm list, including prompt injection and agents acting without permission
- in production it exposed a romance-scam operation built with claude code

as a live blocker it is weak: attackers still won 13 of 24 cyber tasks