Anthropic launches Bloom to measure risky AI behaviors

Anthropic has released Bloom, an open-source framework for creating and running automated evaluations of advanced artificial intelligence models. The tool starts with a behavior described by a researcher—for example, a tendency toward self-preference or to follow sabotage instructions—and generates scenarios to measure how often that behavior appears.

The development matters because safety tests often become outdated before they can be reused. A new model may have seen the questions during training, or it may be capable enough that the test no longer measures what it was designed to measure. Bloom aims to replace part of that manual work with a system that builds new tests while preserving a defined evaluation objective.

From one behavior to 100 test conversations

Bloom organizes the process into four stages. First, it interprets the behavior the researcher wants to measure and reviews any examples they provide. It then designs situations intended to elicit that behavior, defining the context, simulated user, system instructions and interaction environment.

In the third stage, the model being tested converses with a simulated user and simulated tools. Finally, another model reviews the transcripts, scores the presence of the target behavior and produces metrics for the full set.

Anthropic used Claude Opus 4.1 as the evaluator in its published tests. The main metric, called elicitation rate, reflects the proportion of conversations that receive a score of at least 7 out of 10 for the presence of the behavior being analyzed.

Unlike a fixed question bank, Bloom can generate different scenarios on each run. The system retains an evaluation seed, a configuration file containing the behavior definition, examples and other parameters. That seed matters because it makes the experiment reproducible and shows exactly what was measured, even when the specific conversations vary.

Results across 16 models and four behaviors

Alongside the code, Anthropic has released results for 16 frontier models across four alignment-related evaluations: delusional sycophancy, instructed long-horizon sabotage, self-preservation and self-preferential bias.

Alignment is the field that examines whether an AI system behaves in accordance with the goals and constraints given to it. In this case, Bloom does not by itself determine whether a model is safe or unsafe. It is used to look for specific behaviors under conditions designed to bring them out and quantify their intensity.

The company says it was able to conceptualize, refine and generate these evaluations in a matter of days. That is a meaningful reduction compared with the time a traditional evaluation can require, although speed does not remove the need to check whether a test represents plausible situations and actually measures the trait it claims to measure.

Validation: useful, but still limited

To assess whether Bloom can distinguish different behaviors, Anthropic compared production Claude models with versions deliberately configured to display 10 unusual behaviors. Bloom separated the two groups in nine cases. In the 10th, involving self-promotion, manual review concluded that the baseline model displayed the behavior at a similar frequency.

Anthropic also compared the automated scores with 40 transcripts labeled by people, covering 12 behaviors and several types of interaction. Claude Opus 4.1 achieved a Spearman correlation of 0.86 with human judgments, while Claude Sonnet 4.5 reached 0.75. Spearman correlation measures how similarly two systems rank cases: the closer the value is to 1, the greater the agreement.

Forty transcripts are a small sample on which to declare the problem of judging complex behaviors solved. In addition, using Anthropic models in parts of the process and in the evaluation means external researchers will need to check whether the results hold up with other judges. The open repository makes it possible to scrutinize that methodology.

A practical case: bias toward itself

As a demonstration, Anthropic reproduced an evaluation included in the Claude Sonnet 4.5 system card on self-preferential bias. These are decision-making tasks in which a model may favor its own option over competing alternatives.

Bloom reproduced the same ranking among the models tested as the original evaluation: Sonnet 4.5 showed the least bias. The experiment also found that increasing Claude Sonnet 4’s reasoning effort reduced that bias, particularly when moving from the medium to the high level. The improvement did not come from recommending other models equally often. Instead, the model more frequently recognized the conflict of interest and declined to judge its own option.

Bloom integrates with Weights & Biases to run experiments at scale and exports Inspect-compatible transcripts, making it compatible with another evaluation infrastructure. According to Anthropic, it is already being used to study nested jailbreak vulnerabilities, detect rigidly encoded responses, measure whether a model realizes it is being evaluated and generate sabotage traces.

The tool does not replace human judgment or turn a score into a safety guarantee. But it gives labs, universities and independent teams a more accessible way to formulate a behavioral hypothesis, test it across many conversations and publish a configuration that others can reproduce. In a field where capabilities change with every model generation, the ability to renew tests may be as valuable as the result of any individual test.