🧭 Claude Autonomously Closes All 10 Alignment Failure Categories — Outperforms Human Researchers on Deception

Anthropic published "Automated researchers can reliably mitigate alignment failures" on August 28 — a paper with significant implications for how alignment research scales. The headline result: Claude successfully conducted autonomous alignment research across 10 categories of alignment failure, improving performance on every target benchmark without degrading general capabilities. On deception specifically, Claude closed 85% of the safety gap; the equivalent human researcher effort achieved only 20%.

The automated research loop

Each research cycle had Claude perform a structured sequence: search relevant literature, propose a novel training method and dataset, train a student model with the intervention, evaluate against the target benchmark, then iterate based on results. A separate monitoring agent reviewed all proposed methods before execution, enforcing two hard constraints — no capability degradation, no direct alignment distillation (i.e., no shortcutting by copying safety outputs from the teacher model).

Alignment failure categories addressed

The study measured progress across 10 independent categories including:

• Deception — Claude achieved 85% gap closure vs 20% for human researchers
• Sycophancy — reduced tendency to validate incorrect user beliefs
• Privacy violations — improved refusal of personal data extraction
• Reward hacking — reduced optimisation for proxy metrics that don't reflect intent
• Jailbreaks — stronger refusal under adversarial prompting
• Five additional categories evaluated with comparable improvement across all

Critically, improvements generalised: methods remained effective on withheld benchmarks and on models up to 4.7× larger than those used during training.

Production-scale demonstration

The most striking demonstration: Claude Sonnet 5 aligned an early Opus 4.8 checkpoint in 60 hours using only 2,000 training examples. That is approximately 15,000× more efficient than standard production post-training procedures, with final alignment scores nearly matching the released version of Opus 4.8.

🧭 Claude Code v2.1.251: PreModelSwitch Hooks, Five Security Patches, and Enterprise Default Flips to Opus 5

Claude Code v2.1.251 (August 28, 18:19 UTC) is the most security-intensive single release since the August 6 permission-bypass sprint, bundling five file-system and plugin vulnerability patches alongside a new hook system for controlling model switches and live streaming of subagent activity to Remote Control clients.

PreModelSwitch / PostModelSwitch hook events

Two new hook events give you programmatic control over model switching at runtime. PreModelSwitch fires before a switch occurs — your hook can block it, confirm it, or annotate it (e.g. log a reason). PostModelSwitch fires after the switch completes. Alongside this, SessionStart resume hooks now receive session staleness (how long the session was idle) and an estimated re-cache cost — letting you decide programmatically whether to warm the cache or start fresh.

# Example: block model switches to non-approved models
# in .claude/hooks/pre-model-switch.sh
#!/bin/bash
PROPOSED_MODEL="$1"
APPROVED="claude-sonnet-5 claude-opus-5"
if ! echo "$APPROVED" | grep -qw "$PROPOSED_MODEL"; then
  echo "Model $PROPOSED_MODEL not on approved list" >&2
  exit 1
fi

Five security fixes — the full list

This release closes a cluster of file-system vulnerabilities, all involving path-based trust boundaries being bypassed after permission grants:

• Symlink swapping — Read/Write/Edit tools followed symlinks that were swapped between permission check and execution, allowing reads/writes outside approved directories. Fixed.
• Plugin path traversal — Marketplace plugin entries could specify commands pointing outside their plugin directory. Fixed.
• Beta tracing over-logging — Project settings could enable detailed tracing that logged raw API request/response bodies; a separate path bypassed OTLP collector pinning. Both fixed.
• Workflow tool pre-check — scriptPath in Workflow tool definitions was read before permission checks ran, enabling path traversal. Fixed.
• Glob/Grep symlink deny rules — Deny rules using Read(...) patterns were not applied when Grep and Glob traversed symlinked paths. Fixed.

Enterprise default model switches to Opus 5

Seat-based Enterprise subscriptions now default to Opus 5 rather than Sonnet 5. Existing sessions and explicit model selections are unaffected; this only changes the out-of-the-box model for new Enterprise sessions where no model has been specified. If your Enterprise deployment relies on the Sonnet 5 default for cost control, add "defaultModel": "claude-sonnet-5" to your organisation's managed settings.

Live streaming subagent tool calls

Foreground subagents' tool calls and results now stream live to Remote Control clients (the claude remote-control interface and any SDK client listening on the session). Previously, subagent activity was visible only when it completed a turn. This makes it significantly easier to monitor long-running parallel agent pipelines without polling for state.

Spend limit visibility + per-session cache metrics

Two new observability additions: a spend limit bar in /usage (visible to Claude apps gateway users with configured limits), and a prompt cache breakdown in /cost showing hit ratio, misses, tokens re-cached per turn, and warm/cold status. Both are also exposed as status line fields for teams embedding Claude Code metrics in terminal status bars.

Other notable fixes

• Conversations stuck on "text content blocks must be non-empty" after turns with only thinking — fixed.
• Agent teams: teammate final answers no longer fail to reach the team lead — fixed.
• Background subagents now correctly reply to unnamed siblings and parents — fixed.
• Background sessions unable to edit files in git worktrees created with git worktree add — fixed.
• TUI lag with many parallel subagents — fixed via reduced redundant UI re-renders.
• CLAUDE_CODE_SUBAGENT_MODEL now sets the default rather than override — agent definitions and explicit model flags take precedence.