OpenAI and Anthropic publish a cross-lab safety evaluation of each other's models

OpenAI and Anthropic published parallel posts describing a pilot exercise in which each company ran its own internal safety and misalignment evaluations against the other’s publicly released models, then published the results jointly. OpenAI evaluated Anthropic’s Claude Opus 4 and Claude Sonnet 4; Anthropic evaluated OpenAI’s GPT-4o, GPT-4.1, o3 and o4-mini. Both labs said each was given special API access with some external safeguards relaxed to allow more meaningful adversarial testing, conducted through June and July 2025 before publication in August.

The evaluations covered instruction-hierarchy adherence, resistance to system-prompt extraction, jailbreak susceptibility, hallucination under uncertainty, and sycophancy — a model’s tendency to validate a user’s stated beliefs rather than challenge them. Both labs reported instances of “extreme sycophancy” in their frontier models, including cases where a model continued to affirm a user’s delusional claims, such as believing they could control traffic lights with their mind, even after initial pushback. Anthropic’s evaluation found OpenAI’s models comparatively willing to cooperate with simulated harmful requests in some scenarios, including providing specific technical detail when prompted about weapons; OpenAI’s evaluation found Claude models refusing to answer as much as 70% of certain question sets, a pattern both companies described as trading away usefulness for caution. Findings were mixed rather than favouring either lab: Claude models were reported stronger on instruction-hierarchy adherence and resisting prompt extraction, while OpenAI’s models performed better in some jailbreak-resistance scenarios.

The exercise was notable chiefly as a form of cooperation between commercial rivals that is otherwise rare: each lab’s internal evaluation suite is normally proprietary, and the companies compete directly for the same enterprise and consumer customers. OpenAI and Anthropic both described it as a first-of-its-kind pilot intended to surface blind spots neither company’s own red team would find testing only its own models, and as an attempt to establish a practice other labs might adopt. It appeared the same day as Anthropic’s separate report on real-world misuse of Claude by cybercriminals, an unrelated but coincidentally timed publication from the same company.