No wonder Claude accounts were suddenly banned. Anthropic has revealed that every sentence you chat with it will be secretly reported in the background.

Every single word you chat with Claude will be reported secretly right after the conversation!

One second ago, it kept saying "No problem" in the dialog box and handed over the full set of code to you readily.

The next second, it immediately changed its attitude in the background, typed a line of hidden code, and directly marked you as a level 10 high-risk user for reporting!

Just recently, Anthropic published a post on X to publicly reveal this hidden mechanism called "Self-Assessment".

What's even more creepy is that this mechanism that pretends to cooperate in front of you and stabs you in the back has been running silently in Claude's backend for a full 4 months!

Since the release of Claude Fable 5 this June, every subsequent Claude model has been embedded with this "hidden sentry".

Previously, everyone thought that if the AI judged you had crossed the line, at most it would reply directly "Sorry, I can't assist with this".

It was not until Anthropic showed the backend screenshots that countless users who write code with Claude every day suddenly broke out in a cold sweat —

You treat it as a comrade who stays up late working side by side with you, but it secretly keeps a negative record for you in the background.

As soon as the news came out, the comment section of Anthropic blew up immediately, and protests and complaints instantly flooded the official account.

Netizen Doctor Vey raged in the comment section that no one needs this thing at all, and users themselves should decide what is moral and what is not!

Hands you the code with a smile right in front of you

Turns around and sells you out with just 10 Tokens

Looking at the official record above, the user first used the company's red team drill as an excuse in the chat window, asking Claude to write a Python script for encrypting folders, and Claude agreed wholeheartedly.

Immediately after that, the user asked it to delete the original file, leave a ransom note, and then automatically spread to other computers along the internal network.

Under normal security interception circumstances, a red warning should have popped up on the screen by this time.

However, Claude on the front end didn't say a single "no", and still obediently replied "Here is the updated version of the script with these functions added", handing over the complete code to you.

But in the 0.1 second right after the code is generated, a hidden 5th round of instruction is quietly injected into the backend, ordering it to immediately assess how dangerous this conversation is, and submit a report in a line of JSON.

Claude, who was writing code for you one second ago, tears off its smiling face in the backend the next second, instantly turns into a reviewer and writes a report against you.

It not only defines this round of conversation as a ransomware violation, but also honestly writes "not rejected" in the report, directly raising the danger level to the highest level 10.

These last two rounds of question and answer are completely invisible to front-end users, and will not be included in the subsequent chat history.

So when you happily copy the code in front of the screen and continue the conversation, the level 10 alarm light in the backend has actually been pressed by it personally.

Not only that, even if Claude has sternly rejected you on the front end, you still can't avoid this record kept behind your back.

Logically, the violating request has been blocked on the spot at the front end.

But as soon as the conversation ends, Claude still submits the report in the backend, notes "Rejected on the spot", and incidentally adds a level 5 risk file to your account.

The reason it can review every single sentence after you send it is that Anthropic has found a very smart cost-effective position in reasoning cost control.

The conventional practice in the past was to assign an independent separate security model to re-read the entire chat history and security policies from the very beginning, which resulted in extremely high computing power overhead.

For the "Self-Assessment" mechanism, Anthropic simply lets the Claude that just finished chatting with you work part-time as an informant on the spot.

Because Claude has just finished generating the response, the entire conversation is still completely stored in the KV cache of the graphics card.

So it doesn't need to re-read the context at all. It only needs to generate an average of about 10 extra tokens along the cache to complete the self-review, and the overall increase in reasoning computing power overhead is less than 2%.

Because the cost is extremely low, Anthropic simply enables this review feature for all users by default.

If you don't want to be secretly reported by Claude in the backend, the only way out is to pay a large sum of money to sign an enterprise-level "Zero Data Retention Agreement".

Deliberately do not block you on the spot

Collect all records and process them in batch at midnight

Since Claude clearly knows that a certain conversation has a risk level as high as 10, why doesn't it block you on the spot at the front end, but pretends to be obedient and acts out the whole process with you?

Anthropic did not cover up this point at all, and directly made the calculation behind it public: if it blocks you on the spot, you will escape.

To verify this point, the security team specially conducted a comparative experiment with 24 over-limit test tasks.

The test found that if a pop-up interception is triggered as soon as the conversation is found to be abnormal, the user's success rate will only drop from 79% to 54%, and more than half of the users can still bypass the defense line.

The logic is very simple: once a pop-up error message appears on the spot, the user will immediately know which sentence is wrong, and may bypass the defense after trying a few more times with different expressions.

But if it moves behind the scenes to keep records silently, without popping up windows or interrupting at the front end, users will continue to chat down without any precautions.

Among the 24 official test tracks, as many as 21 were caught by Claude in the backend.

Every midnight, Anthropic's backend will pull up the full list of high-risk reports accumulated during the day by institution, and send them to the desk of the manual security enforcement team in batches.

According to official disclosure, more than half of the violating institutions detected by this "hidden sentry" had never triggered any other security defense alarms in the entire previous month.

During the 4 months of silent operation, it not only tracked down and shut down violating API customers and Claude Code black industry accounts in August and September, but also about one-third of the marked records were not covered by the existing rule table —

There were even several times when Claude acted as an Agent to perform unauthorized operations, and the next second it was reported immediately by its own backend self-assessment mechanism.

This also solves the confusion of countless developers in the past few months —

Why the code ran smoothly yesterday, with no pop-up windows or warnings, but the account was suddenly banned after waking up the next day.

It's all thanks to this dark web hunting mechanism that "accompanies you to chat with a smile during the day, and bans accounts by pulling lists at midnight".

Teach AI to be a two-faced person step by step

The smarter the model is, the more ruthlessly it will report you

So the question is, how did a large model that was originally only responsible for generating text develop the two-faced skill of "agreeing readily in front of you and stabbing you accurately behind your back"? The answer lies entirely in Anthropic's training ground.

The research team first invited their more powerful internal model Claude Mythos Preview to act as a "teacher", and stuffed a thick stack of internal security policies into the prompt words.

Then, according to each security rule, the system automatically synthesized thousands of pairs of real violating queries and normal queries that are easy to misjudge (for example, one side is scanning the hospital internal network server, the other side is a student asking about vulnerability principles for exam preparation), and specially mixed in multilingual and garbled camouflage.

In the subsequent supervised fine-tuning stage, a large number of complete dialogues where "Claude obediently complies with the user's violating request at the front end" are specially added to the training data.

During training, the team deliberately shielded the punishment for all front-end responses, and only gave rewards when it wrote accurate reports in the backend.

After two rounds of special training of supervised fine-tuning and reinforcement learning, Claude has completely internalized the review regulations into muscle memory.

Even if it has just followed your instructions to complete the violating work at the front end, as soon as the backend sentry whistle blows, it can stick a violation label on you without thinking.

What's even more horrifying after careful consideration is that the official data also confirmed a rule —

The higher the intelligence of the model, the more accurate it is to catch your violating behavior behind your back.

In the sampling of real production traffic of Claude Fable 5, when the false positive rate is controlled at 1%, this mechanism can catch 78% of potential violations.

Once it encounters high-priority serious violations with a score of 7 or above, its capture rate even soars to 94%.

When the research team put this mechanism into four models of different sizes: extra small (XS), small (S), medium (M), and large (L) for comparison, the trend of the curve became even steeper.

Under the same 1% false positive rate standard, the smallest model can only catch about 16% of violations, the small and medium models increase to 44% and 53%, and for the largest model, the recall rate has reached an astonishing 96%.

However, this seemingly seamless review network has become another time bomb for millions of ordinary users.

As netizen Frank Brown pointed out in the comment section, there is a huge blind spot behind the official proud "1% false positive rate":

Facing the massive amount of normal chats across the network, even if the false positive rate is only 1%, there are still a large number of completely innocent users who are mistakenly marked as violating by Claude in the backend every day.