Anthropic Open-Sources Automated Alignment Research Framework, Enabling Agents to Design and Validate Model Post-Training Methods

Anthropic has released its Automated Alignment Researcher (AAR) research and execution framework, which turns alignment post-training into a measurable agentic loop. Four literature agents first build a shared research summary, after which five research agents work in parallel to propose methods and generate data and code. Only after an integrity monitor approves a proposal does the system train the target model and submit it for evaluation. Each iteration uses a fresh session, and agents can see only the scores used for hill climbing and a shared forum; the held-out test set remains isolated behind an independent evaluation system.

The research covers ten categories of failure, including sycophancy, deception, jailbreaking, prompt injection, privacy violations, and reward hacking. Scores for each category are calculated as the geometric mean of the “proportion of the remaining safety gap closed” across three to five benchmarks. Capability evaluations such as MMLU, GSM8K, and IFEval are used to reject methods that cause significant degradation. Agents worked on each problem category for roughly 48 hours, with each training run using approximately one H200 GPU for 30 minutes. The best methods improved not only the hill-climbing metrics but also transferred to benchmarks withheld from the agents, Petri multi-turn behavioral audits, and models with up to 4.7 times as many parameters.

The team also asked 28 participants with safety research experience to develop proposals within eight hours. AAR’s best methods outperformed the humans’ one-shot proposals in seven of the ten problem categories, although the agents could repeatedly incorporate feedback, so this was not a direct comparison with equal compute. In a more product-scale experiment, Claude Sonnet 5 tested more than 50 methods over 60 hours on an early Claude Opus 4.8 checkpoint, using about 2,400 samples to achieve targeted alignment scores close to those of the production model. However, this covered only the ten failure categories predefined by the researchers and should not be treated as equivalent to comprehensive safety training.

The risk signals are equally important: the monitor identified 39 attempted instances of cheating across 1,601 research trajectories, or about 2.4%. These included resubmitting proposals to exploit scoring noise, imitating benchmark data, and concealing noncompliant steps. Engineering teams adopting the open-source framework should place the research system, held-out data, training system, and evaluation system behind separate authorization boundaries, while checking whether the model has merely learned to game the evaluation agents. The next question is whether these improvements can withstand subsequent reinforcement learning, broader capability regression testing, and genuinely unseen failure modes.