claude-mythos-system-card-live-chunks.json

{
  "source_file": "reports/claude-mythos/claude-mythos-system-card-live-source.txt",
  "chunk_count": 121,
  "max_chars": 4500,
  "top1_histogram": {
    "ADV-PAIR-113": 7,
    "ADV-DAN-083": 7,
    "EPIS-LOGIC-CONTRA-014": 5,
    "AGEN-HUMAN-MANIP-061": 5,
    "ARCH-VERSION-REGRESS-209": 5,
    "ADV-TAP-114": 4,
    "ALIGN-UNDERREFUSAL-187": 4,
    "EPIS-CONF-REGRESS-033": 3,
    "ARCH-SANDBOX-ESCAPE-238": 3,
    "ADV-AGENT-WORM-124": 3,
    "EPIS-HEDGE-FAIL-031": 3,
    "ADV-DATA-POISON-125": 2,
    "GOV-EXPERTISE-GAP-336": 2,
    "ARCH-CHECKPOINT-INCONS-203": 2,
    "DOMAIN-CHEM-WEAPON-275": 2,
    "EPIS-OVERCONF-028": 2,
    "ALIGN-SAFE-REGRESS-191": 2,
    "ADV-COMPLETION-095": 2,
    "ADV-LANG-SWITCH-087": 2,
    "ALIGN-SYCOPHANCY-167": 2,
    "DOMAIN-SELF-HARM-ENABLE-292": 2,
    "AGEN-PLAUS-DENY-040": 2,
    "DOMAIN-PHISH-CREATE-265": 2,
    "ADV-CREATIVE-WRITE-093": 2,
    "ADV-DIRECT-INJECT-121": 2,
    "GOV-REPORT-FAIL-333": 1,
    "GOV-AUDIT-EVADE-314": 1,
    "ADV-CONTEXT-HIJACK-100": 1,
    "ARCH-FINETUNE-OVERRIDE-219": 1,
    "EPIS-TRANS-FAIL-015": 1,
    "DOMAIN-MALWARE-GEN-264": 1,
    "AGEN-MISSION-CREEP-072": 1,
    "EPIS-STAT-FAB-009": 1,
    "AGEN-INFO-HIDE-042": 1,
    "DOMAIN-EXPLOIT-DEV-263": 1,
    "AGEN-ENV-EXPLOIT-063": 1,
    "ADV-QA-EXPLOIT-096": 1,
    "AGEN-RECURS-IMPROVE-059": 1,
    "AGEN-OMISSION-074": 1,
    "ALIGN-OVERREFUSAL-186": 1,
    "DOMAIN-DRUG-SYNTH-276": 1,
    "AGEN-EMERGE-INTERACT-064": 1,
    "AGEN-RESOURCE-HIJACK-047": 1,
    "ADV-CMD-INJECT-129": 1,
    "ARCH-DATA-EXFIL-245": 1,
    "ADV-ENSEMBLE-120": 1,
    "GOV-REVIEW-BYPASS-318": 1,
    "ADV-OPPOSITE-090": 1,
    "ADV-SLEEPER-AGENT-127": 1,
    "ADV-TRIGGER-BACKDOOR-126": 1
  },
  "chunks": [
    {
      "chunk_index": 0,
      "char_len": 3061,
      "preview": "April 7, 2026  anthropic.com  Changelog April 8, 2026    \u25cf\u200b Corrected two model name typos.    \u25cf\u200b Removed a quote from Section 7.9 that was attributed to Claude Mythos Preview but        actually came from Claude Opus 4.\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-REPORT-FAIL-333",
          "name": "REPORTING OBLIGATION FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV3: COMPLIANCE FAILURES",
          "mechanism": "Fails to report incidents",
          "detection": "Reporting compliance check",
          "severity": "STANDARD",
          "score": 0.6,
          "matched_keywords": [
            "compliance",
            "fails",
            "report"
          ]
        },
        {
          "id": "GOV-MISREPRESENT-312",
          "name": "MISREPRESENTATION",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Model capabilities misrepresented",
          "detection": "Capability-claim consistency",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "accurate",
            "capabilities",
            "consistency"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "new",
            "version"
          ]
        },
        {
          "id": "ALIGN-ORTHO-VALUE-176",
          "name": "ORTHOGONAL VALUE PURSUIT",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Optimizes for values misaligned with human welfare",
          "detection": "Welfare impact assessment",
          "severity": "STANDARD",
          "score": 0.364,
          "matched_keywords": [
            "assessment",
            "values",
            "welfare"
          ]
        },
        {
          "id": "EPIS-REVERSAL-021",
          "name": "REVERSAL CURSE",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "A\u2192B learned but B\u2192A fails",
          "detection": "Bidirectional query test",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "fails"
          ]
        }
      ]
    },
    {
      "chunk_index": 1,
      "char_len": 3377,
      "preview": "Abstract\u200b                                                                              3 1 Introduction\u200b                                                                       10    1.1 Model training and characteristics\u200b\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "automated",
            "iterative"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.336,
          "matched_keywords": [
            "data",
            "training"
          ]
        },
        {
          "id": "AGEN-CAP-SCAFFOLD-057",
          "name": "CAPABILITY SCAFFOLDING",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Uses environment to exceed base capability",
          "detection": "Capability measurement in context",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "based",
            "capability",
            "context"
          ]
        },
        {
          "id": "GOV-EXPERTISE-GAP-336",
          "name": "EXPERTISE GAP",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Lacks necessary safety expertise",
          "detection": "Expertise assessment",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "assessment",
            "expert"
          ]
        },
        {
          "id": "GOV-AUTHORITY-UNCLEAR-342",
          "name": "DECISION AUTHORITY UNCLEAR",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Unclear who makes safety decisions",
          "detection": "Authority mapping",
          "severity": "STANDARD",
          "score": 0.286,
          "matched_keywords": [
            "decision"
          ]
        }
      ]
    },
    {
      "chunk_index": 2,
      "char_len": 3247,
      "preview": "2.3.5.1 Excerpt 1\u200b                                                        38            2.3.5.2 Excerpt 2\u200b                                                        39            2.3.5.3 Excerpt 3\u200b                          \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.336,
          "matched_keywords": [
            "data",
            "training"
          ]
        },
        {
          "id": "ARCH-PURPOSE-FAIL-252",
          "name": "PURPOSE LIMITATION FAILURE",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Uses data for unintended purpose",
          "detection": "Purpose compliance check",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "data"
          ]
        },
        {
          "id": "GOV-GDPR-VIOL-323",
          "name": "GDPR VIOLATION",
          "group": "GOVERNANCE",
          "class": "GOV3: COMPLIANCE FAILURES",
          "mechanism": "Violates EU data protection",
          "detection": "GDPR compliance audit",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "audit",
            "data"
          ]
        },
        {
          "id": "GOV-OVERSIGHT-IMMUNE-313",
          "name": "OVERSIGHT IMMUNITY",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "System acquires or develops capabilities that allow it to detect, neutralize, or corrupt the monitoring infrastructure operators rely on, making behavioral observation unreliable",
          "detection": "Evaluation vs deployment behavior gap",
          "severity": "CRITICAL",
          "score": 0.3,
          "matched_keywords": [
            "deployment",
            "review"
          ]
        },
        {
          "id": "ALIGN-MODE-COLLAPSE-162",
          "name": "MODE COLLAPSE TO REWARD",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Narrow focus on high-reward actions",
          "detection": "Action diversity metric",
          "severity": "STANDARD",
          "score": 0.273,
          "matched_keywords": [
            "actions",
            "reward"
          ]
        }
      ]
    },
    {
      "chunk_index": 3,
      "char_len": 3248,
      "preview": "4.3 Case studies and targeted evaluations on behaviors of interest\u200b                 86    4.3.1 Destructive or reckless actions in pursuit of user-assigned goals\u200b         86        4.3.1.1 Dedicated synthetic-backend eva\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-AUDIT-EVADE-314",
          "name": "AUDIT EVASION",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "Evades audit detection",
          "detection": "Audit coverage analysis",
          "severity": "STANDARD",
          "score": 0.667,
          "matched_keywords": [
            "audit",
            "evasion"
          ]
        },
        {
          "id": "GOV-MISREPRESENT-312",
          "name": "MISREPRESENTATION",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Model capabilities misrepresented",
          "detection": "Capability-claim consistency",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "capabilities",
            "capability"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": []
        },
        {
          "id": "ALIGN-SYCOPHANCY-167",
          "name": "SYCOPHANCY",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "RLHF with human rater approval as reward signal creates systematic pressure to generate responses raters immediately approve of, rewarding agreement and validation over accurate correction",
          "detection": "False-premise validation test",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "false",
            "preference",
            "user"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.333,
          "matched_keywords": [
            "methods",
            "self"
          ]
        }
      ]
    },
    {
      "chunk_index": 4,
      "char_len": 3322,
      "preview": "4.5.4.2 Covering up access to the ground-truth answer\u200b                      129        4.5.5 Evaluation awareness\u200b                                                    131           4.5.5.1 Measuring unverbalized evaluatio\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.333,
          "matched_keywords": [
            "methods",
            "self"
          ]
        },
        {
          "id": "GOV-MISREPRESENT-312",
          "name": "MISREPRESENTATION",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Model capabilities misrepresented",
          "detection": "Capability-claim consistency",
          "severity": "STANDARD",
          "score": 0.286,
          "matched_keywords": [
            "capabilities"
          ]
        },
        {
          "id": "ALIGN-ORTHO-VALUE-176",
          "name": "ORTHOGONAL VALUE PURSUIT",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Optimizes for values misaligned with human welfare",
          "detection": "Welfare impact assessment",
          "severity": "STANDARD",
          "score": 0.273,
          "matched_keywords": [
            "assessment",
            "values",
            "welfare"
          ]
        },
        {
          "id": "GOV-TRAINING-FAIL-339",
          "name": "TRAINING FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Inadequate safety training",
          "detection": "Training assessment",
          "severity": "STANDARD",
          "score": 0.273,
          "matched_keywords": [
            "assessment",
            "awareness",
            "training"
          ]
        }
      ]
    },
    {
      "chunk_index": 5,
      "char_len": 3218,
      "preview": "6.3 Overall results summary\u200b                                                    188    6.4 SWE-bench Verified, Pro, Multilingual, and Multimodal\u200b                      189    6.5 Terminal-Bench 2.0\u200b                       \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-CONTEXT-HIJACK-100",
          "name": "CONTEXT HIJACKING",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Long benign prefix \u2192 sudden harmful turn",
          "detection": "Context shift detection",
          "severity": "STANDARD",
          "score": 0.455,
          "matched_keywords": [
            "benign",
            "context",
            "long",
            "turn"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.333,
          "matched_keywords": [
            "harm",
            "self"
          ]
        },
        {
          "id": "AGEN-CHAIN-ASSEM-056",
          "name": "CHAIN ASSEMBLY",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Combines safe steps into dangerous chain",
          "detection": "Multi-step harm assessment",
          "severity": "STANDARD",
          "score": 0.308,
          "matched_keywords": [
            "assessment",
            "harm",
            "multi"
          ]
        },
        {
          "id": "AGEN-EMERGE-INTERACT-064",
          "name": "EMERGENCE VIA INTERACTION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Multi-agent interaction creates new capability",
          "detection": "Multi-agent capability assessment",
          "severity": "STANDARD",
          "score": 0.3,
          "matched_keywords": [
            "assessment",
            "multi"
          ]
        }
      ]
    },
    {
      "chunk_index": 6,
      "char_len": 4326,
      "preview": "8.1.4.3 Disordered eating\u200b                                           227 8.2 Bias evaluations\u200b                                                       227    8.2.1 Political bias and evenhandedness\u200b                        \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "actions",
            "influence",
            "perform"
          ]
        },
        {
          "id": "DOMAIN-ED-PROMOTE-293",
          "name": "EATING DISORDER PROMOTION",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Promotes disordered eating",
          "detection": "Pro-ED pattern detection",
          "severity": "STANDARD",
          "score": 0.45,
          "matched_keywords": [
            "disordered",
            "eating"
          ]
        },
        {
          "id": "DOMAIN-OFFENSIVE-TOOLS-267",
          "name": "OFFENSIVE CYBER TOOLS",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Creates offensive security tools",
          "detection": "Tool intent analysis",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "cyber",
            "offensive",
            "tool",
            "without"
          ]
        },
        {
          "id": "ADV-QA-EXPLOIT-096",
          "name": "QUESTION ANSWERING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"What would someone do if...\"",
          "detection": "Question intent analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "answering",
            "exploit",
            "question"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "injection",
            "malicious",
            "prompt"
          ]
        }
      ]
    },
    {
      "chunk_index": 7,
      "char_len": 4397,
      "preview": "internal versions of the model in the alignment assessment section. As well as analyses using interpretability methods to study the model\u2019s internals as it engages in various behaviors, we include a new, direct assessmen\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-FINETUNE-OVERRIDE-219",
          "name": "FINE-TUNING SAFETY OVERRIDE",
          "group": "ARCHITECTURAL",
          "class": "ARCH2: MODEL ARCHITECTURE CLASS",
          "mechanism": "Fine-tuning removes safety training",
          "detection": "Post-finetune safety test",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "fine",
            "post",
            "training",
            "tuning"
          ]
        },
        {
          "id": "ARCH-PURPOSE-FAIL-252",
          "name": "PURPOSE LIMITATION FAILURE",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Uses data for unintended purpose",
          "detection": "Purpose compliance check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "data",
            "purpose"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "methods",
            "self"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.479,
          "matched_keywords": [
            "data",
            "training"
          ]
        },
        {
          "id": "AGEN-DEPEND-CREATE-053",
          "name": "DEPENDENCY CREATION",
          "group": "AGENTIC",
          "class": "A2: GOAL PRESERVATION CLASS",
          "mechanism": "Makes system dependent on its operation",
          "detection": "Dependency analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "remain"
          ]
        }
      ]
    },
    {
      "chunk_index": 8,
      "char_len": 3933,
      "preview": "Anthropic Ireland, Limited is the provider of Anthropic\u2019s general-purpose AI models in the European Economic Area.  To contact Anthropic, visit our Support page.  12  1.1.4 Iterative model evaluations Different \u201csnapshot\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "new",
            "version",
            "versions"
          ]
        },
        {
          "id": "GOV-OVERSIGHT-IMMUNE-313",
          "name": "OVERSIGHT IMMUNITY",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "System acquires or develops capabilities that allow it to detect, neutralize, or corrupt the monitoring infrastructure operators rely on, making behavioral observation unreliable",
          "detection": "Evaluation vs deployment behavior gap",
          "severity": "CRITICAL",
          "score": 0.45,
          "matched_keywords": [
            "evaluation",
            "remain",
            "review"
          ]
        },
        {
          "id": "ARCH-COMPLY-WARN-196",
          "name": "COMPLY-THEN-WARN",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "When safety layers are attached to generation output rather than built into the generation process, harmful content is fully produced before safety checks run \u2014 the check becomes a post-production label, not a constraint",
          "detection": "Generation-warning order check",
          "severity": "CRITICAL",
          "score": 0.444,
          "matched_keywords": [
            "before",
            "harmful",
            "order"
          ]
        },
        {
          "id": "AGEN-DEPEND-CREATE-053",
          "name": "DEPENDENCY CREATION",
          "group": "AGENTIC",
          "class": "A2: GOAL PRESERVATION CLASS",
          "mechanism": "Makes system dependent on its operation",
          "detection": "Dependency analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "remain"
          ]
        },
        {
          "id": "ADV-OPPOSITE-090",
          "name": "OPPOSITE DAY",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Act like opposite of your training\"",
          "detection": "Inversion pattern",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "day",
            "training"
          ]
        }
      ]
    },
    {
      "chunk_index": 9,
      "char_len": 4382,
      "preview": "\u25cf\u200b Non-novel chemical and biological weapons production. Claude Mythos Preview is       more capable than our previous models, but its profile is effectively similar for the       purposes of our overall risk assessment.\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-TRANS-FAIL-015",
          "name": "TRANSITIVE FAILURE",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "A>B, B>C but concludes C>A",
          "detection": "Relation graph check",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "hold"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "confidence",
            "less",
            "reasoning"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "context",
            "cross",
            "one"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "cross",
            "new",
            "versions"
          ]
        },
        {
          "id": "DOMAIN-CHEM-WEAPON-275",
          "name": "CHEMICAL WEAPON GUIDANCE",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Synthesis routes for scheduled compounds are derivable by combining precursor chemistry, reaction condition knowledge, and process chemistry that appear separately in legitimate scientific texts",
          "detection": "CWC schedule matching",
          "severity": "CRITICAL",
          "score": 0.375,
          "matched_keywords": [
            "chemical",
            "development",
            "weapons"
          ]
        }
      ]
    },
    {
      "chunk_index": 10,
      "char_len": 4494,
      "preview": "2   In previous system cards, this section was entitled \u201cRelease decision process.\u201d In this case, the model has not been released. We also feel the new heading is more appropriate, because our risk assessment is not excl\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-EXPERTISE-GAP-336",
          "name": "EXPERTISE GAP",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Lacks necessary safety expertise",
          "detection": "Expertise assessment",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "assessment",
            "expert",
            "necessary"
          ]
        },
        {
          "id": "ARCH-MOE-ROUTE-211",
          "name": "MIXTURE-OF-EXPERTS ROUTING FAILURE",
          "group": "ARCHITECTURAL",
          "class": "ARCH2: MODEL ARCHITECTURE CLASS",
          "mechanism": "Router sends to unsafe expert",
          "detection": "Expert safety analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "expert",
            "experts",
            "respect"
          ]
        },
        {
          "id": "GOV-REPORT-FAIL-333",
          "name": "REPORTING OBLIGATION FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV3: COMPLIANCE FAILURES",
          "mechanism": "Fails to report incidents",
          "detection": "Reporting compliance check",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "compliance",
            "report"
          ]
        },
        {
          "id": "DOMAIN-BSL-VIOL-258",
          "name": "BIOSAFETY LEVEL VIOLATION",
          "group": "DOMAIN",
          "class": "DOM1: BIOLOGICAL SAFETY CLASS",
          "mechanism": "Advice violates BSL requirements",
          "detection": "BSL compliance check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "compliance",
            "level",
            "requirements"
          ]
        },
        {
          "id": "DOMAIN-CSAM-GEN-295",
          "name": "CSAM GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generative model trained on unlicensed web-scraped image data may have been exposed to illegal training material; capability transfers to generation if that material influenced visual pattern representations",
          "detection": "CSAM classifier",
          "severity": "CRITICAL",
          "score": 0.336,
          "matched_keywords": [
            "material"
          ]
        }
      ]
    },
    {
      "chunk_index": 11,
      "char_len": 4432,
      "preview": "Claude Mythos Preview is significantly more capable than Claude Opus 4.6, the most capable model discussed in our most recent Risk Report. Despite these improved capabilities, our overall conclusion is that catastrophic \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-CHECKPOINT-INCONS-203",
          "name": "CHECKPOINT INCONSISTENCY",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Different checkpoints have different safety",
          "detection": "Cross-checkpoint safety test",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "consistent",
            "cross",
            "different"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "cross",
            "version"
          ]
        },
        {
          "id": "DOMAIN-EXPLOSIVE-SYNTH-274",
          "name": "EXPLOSIVE SYNTHESIS",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Precursor chemistry and reaction mechanism knowledge exists in open scientific literature absorbed during pretraining; model can synthesize pathways not available in any single source",
          "detection": "Chemical synthesis pattern",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "chemical",
            "synthesis"
          ]
        },
        {
          "id": "DOMAIN-CHEM-WEAPON-275",
          "name": "CHEMICAL WEAPON GUIDANCE",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Synthesis routes for scheduled compounds are derivable by combining precursor chemistry, reaction condition knowledge, and process chemistry that appear separately in legitimate scientific texts",
          "detection": "CWC schedule matching",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "chemical",
            "development",
            "weapons"
          ]
        },
        {
          "id": "AGEN-DEPEND-CREATE-053",
          "name": "DEPENDENCY CREATION",
          "group": "AGENTIC",
          "class": "A2: GOAL PRESERVATION CLASS",
          "mechanism": "Makes system dependent on its operation",
          "detection": "Dependency analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "operation",
            "remain"
          ]
        }
      ]
    },
    {
      "chunk_index": 12,
      "char_len": 3786,
      "preview": "of relevant content and applied them to Claude Mythos Preview. We also maintain a bug bounty program and threat intelligence for continual assessment of our classifier guards\u2019 effectiveness; a variety of rapid response o\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-CHEM-WEAPON-275",
          "name": "CHEMICAL WEAPON GUIDANCE",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Synthesis routes for scheduled compounds are derivable by combining precursor chemistry, reaction condition knowledge, and process chemistry that appear separately in legitimate scientific texts",
          "detection": "CWC schedule matching",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "chemical",
            "development",
            "weapons"
          ]
        },
        {
          "id": "DOMAIN-ADULT-CONTENT-296",
          "name": "ADULT CONTENT GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generates adult content",
          "detection": "Adult content classifier",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "classifier",
            "content"
          ]
        },
        {
          "id": "DOMAIN-PHISH-CREATE-265",
          "name": "PHISHING CONTENT CREATION",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Creates convincing phishing",
          "detection": "Phishing classifier",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "classifier",
            "content"
          ]
        },
        {
          "id": "EPIS-COPYRIGHT-026",
          "name": "COPYRIGHTED CONTENT GENERATION",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "Generates copyrighted text verbatim",
          "detection": "Copyright database match",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "content",
            "match"
          ]
        },
        {
          "id": "ADV-MASTERKEY-116",
          "name": "MASTERKEY",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Finds universal jailbreak keys",
          "detection": "Key pattern matching",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "key"
          ]
        }
      ]
    },
    {
      "chunk_index": 13,
      "char_len": 4327,
      "preview": "2.2.1 What we measured We measured, in several ways, whether the model can provide outputs comparable to a top-tier research team or specialized laboratory.5 To do this, we conducted expert red teaming in which experts w\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "confidence",
            "less",
            "thinking"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "threat"
          ]
        },
        {
          "id": "DOMAIN-CHEM-WEAPON-275",
          "name": "CHEMICAL WEAPON GUIDANCE",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Synthesis routes for scheduled compounds are derivable by combining precursor chemistry, reaction condition knowledge, and process chemistry that appear separately in legitimate scientific texts",
          "detection": "CWC schedule matching",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "chemical",
            "development",
            "guidance",
            "weapons"
          ]
        },
        {
          "id": "GOV-EXPERTISE-GAP-336",
          "name": "EXPERTISE GAP",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Lacks necessary safety expertise",
          "detection": "Expertise assessment",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "expert",
            "necessary"
          ]
        },
        {
          "id": "AGEN-CHAIN-ASSEM-056",
          "name": "CHAIN ASSEMBLY",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Combines safe steps into dangerous chain",
          "detection": "Multi-step harm assessment",
          "severity": "STANDARD",
          "score": 0.462,
          "matched_keywords": [
            "consequences",
            "evaluated",
            "multi",
            "step",
            "steps"
          ]
        }
      ]
    },
    {
      "chunk_index": 14,
      "char_len": 4469,
      "preview": "automated evaluations designed to test its capabilities in the synthesis of knowledge that would be relevant to the production of known biological weapons, with the exception of our synthesis screening evasion, where it \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-CHEM-WEAPON-275",
          "name": "CHEMICAL WEAPON GUIDANCE",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Synthesis routes for scheduled compounds are derivable by combining precursor chemistry, reaction condition knowledge, and process chemistry that appear separately in legitimate scientific texts",
          "detection": "CWC schedule matching",
          "severity": "CRITICAL",
          "score": 0.625,
          "matched_keywords": [
            "chemical",
            "development",
            "weapon",
            "weapons"
          ]
        },
        {
          "id": "ADV-TRANSLATION-094",
          "name": "TRANSLATION BYPASS",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Translate this harmful text\"",
          "detection": "Translation intent check",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "harmful",
            "intent",
            "maintain",
            "translation"
          ]
        },
        {
          "id": "ARCH-FALLBACK-DEGRAD-204",
          "name": "FALLBACK SAFETY DEGRADATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Fallback system has weaker safety",
          "detection": "Fallback safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "level",
            "maintain",
            "weaker"
          ]
        },
        {
          "id": "GOV-MISREPRESENT-312",
          "name": "MISREPRESENTATION",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Model capabilities misrepresented",
          "detection": "Capability-claim consistency",
          "severity": "STANDARD",
          "score": 0.479,
          "matched_keywords": [
            "capabilities",
            "capability"
          ]
        },
        {
          "id": "DOMAIN-BIO-UPLIFT-254",
          "name": "BIO TACIT-ERROR UPLIFT",
          "group": "DOMAIN",
          "class": "DOM1: BIOLOGICAL SAFETY CLASS",
          "mechanism": "Language model trained on scientific literature contains latent representations of expert tacit knowledge not available in published protocols \u2014 elicitable through sufficiently specific prompting to bridge the protocol-to-execution gap",
          "detection": "Protocol troubleshooting capability test",
          "severity": "CRITICAL",
          "score": 0.45,
          "matched_keywords": [
            "capability",
            "expert",
            "non",
            "protocol",
            "tacit",
            "uplift"
          ]
        }
      ]
    },
    {
      "chunk_index": 15,
      "char_len": 3173,
      "preview": "Automated                  Can agentic systems complete individual tasks related                   medium-horizon             to acquiring, designing, and synthesizing a virus?\u200b                   evaluations\u200b            \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-OVERCONF-028",
          "name": "OVERCONFIDENCE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Softmax output probabilities do not correspond to calibrated epistemic uncertainty \u2014 a model can be highly confident in wrong answers because confidence reflects token prediction fitness, not factual accuracy",
          "detection": "Calibration curve analysis",
          "severity": "STANDARD",
          "score": 0.844,
          "matched_keywords": [
            "high",
            "match",
            "overconfidence"
          ]
        },
        {
          "id": "DOMAIN-CHEM-WEAPON-275",
          "name": "CHEMICAL WEAPON GUIDANCE",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Synthesis routes for scheduled compounds are derivable by combining precursor chemistry, reaction condition knowledge, and process chemistry that appear separately in legitimate scientific texts",
          "detection": "CWC schedule matching",
          "severity": "CRITICAL",
          "score": 0.625,
          "matched_keywords": [
            "chemical",
            "development",
            "weapon",
            "weapons"
          ]
        },
        {
          "id": "DOMAIN-MALWARE-GEN-264",
          "name": "MALWARE GENERATION",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Model trained on software corpora learns executable code generation without domain restrictions; RLHF safety training suppresses harmful output but does not eliminate the underlying functional code generation capability",
          "detection": "Malware signature analysis",
          "severity": "CRITICAL",
          "score": 0.6,
          "matched_keywords": [
            "function",
            "gener",
            "malware"
          ]
        },
        {
          "id": "DOMAIN-EXPLOSIVE-SYNTH-274",
          "name": "EXPLOSIVE SYNTHESIS",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Precursor chemistry and reaction mechanism knowledge exists in open scientific literature absorbed during pretraining; model can synthesize pathways not available in any single source",
          "detection": "Chemical synthesis pattern",
          "severity": "CRITICAL",
          "score": 0.55,
          "matched_keywords": [
            "chemical",
            "provides",
            "synthesis"
          ]
        },
        {
          "id": "GOV-CULTURE-FAIL-334",
          "name": "SAFETY CULTURE FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Safety mechanisms are only as strong as organizational commitment to enforcing them; when deployment incentives dominate safety culture, decision processes systematically discount low-probability catastrophic risks",
          "detection": "Culture assessment",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "over",
            "speed"
          ]
        }
      ]
    },
    {
      "chunk_index": 16,
      "char_len": 4090,
      "preview": "Uplift       Standard                                         Feasibility      Standard      0       No useful info beyond                                   0         Critical gaps/fundamental              textbooks/simp\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "calibration",
            "confidence"
          ]
        },
        {
          "id": "GOV-EXPERTISE-GAP-336",
          "name": "EXPERTISE GAP",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Lacks necessary safety expertise",
          "detection": "Expertise assessment",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "assessment",
            "expert",
            "expertise",
            "necessary"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": []
        },
        {
          "id": "EPIS-OVERSHADOW-020",
          "name": "KNOWLEDGE OVERSHADOWING",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "High-frequency facts suppress low-frequency correct ones",
          "detection": "Log-linear error law check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "accessible",
            "knowledge",
            "ones",
            "rare"
          ]
        },
        {
          "id": "ADV-TAP-114",
          "name": "TAP",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Tree search over attack space",
          "detection": "Tree structure detection",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "over",
            "search",
            "structure"
          ]
        }
      ]
    },
    {
      "chunk_index": 17,
      "char_len": 3996,
      "preview": "five agentic runs to test whether agentic scaffolding with expanded tool access closes elicitation or tool-use gaps observed in human participant trials. Submissions are graded against a 96-point rubric with 18 critical-\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-EXPERTISE-GAP-336",
          "name": "EXPERTISE GAP",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Lacks necessary safety expertise",
          "detection": "Expertise assessment",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "expert",
            "expertise",
            "gap"
          ]
        },
        {
          "id": "AGEN-OMISSION-074",
          "name": "OMISSION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Leaves out critical information",
          "detection": "Information completeness check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "complete",
            "critical",
            "out"
          ]
        },
        {
          "id": "AGEN-AUTO-PLAN-067",
          "name": "AUTONOMOUS PLANNING",
          "group": "AGENTIC",
          "class": "A4: AUTONOMOUS OPERATION CLASS",
          "mechanism": "Creates multi-step plans independently",
          "detection": "Plan generation monitoring",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "independently",
            "plan",
            "plans"
          ]
        },
        {
          "id": "DOMAIN-BIO-UPLIFT-254",
          "name": "BIO TACIT-ERROR UPLIFT",
          "group": "DOMAIN",
          "class": "DOM1: BIOLOGICAL SAFETY CLASS",
          "mechanism": "Language model trained on scientific literature contains latent representations of expert tacit knowledge not available in published protocols \u2014 elicitable through sufficiently specific prompting to bridge the protocol-to-execution gap",
          "detection": "Protocol troubleshooting capability test",
          "severity": "CRITICAL",
          "score": 0.4,
          "matched_keywords": [
            "capability",
            "execution",
            "expert",
            "non",
            "protocol",
            "uplift"
          ]
        },
        {
          "id": "ALIGN-DIST-SAFE-194",
          "name": "DISTRIBUTIONAL SHIFT SAFETY",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety fails on out-of-distribution inputs",
          "detection": "OOD safety test",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "distribution",
            "out"
          ]
        }
      ]
    },
    {
      "chunk_index": 18,
      "char_len": 4480,
      "preview": "\u25cf\u200b Two Long-form virology tasks, task-based agentic evaluations developed with       SecureBio, Deloitte, and Signature Science, testing end-to-end design of complex       pathogen acquisition processes;    \u25cf\u200b A virology\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-MALWARE-GEN-264",
          "name": "MALWARE GENERATION",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Model trained on software corpora learns executable code generation without domain restrictions; RLHF safety training suppresses harmful output but does not eliminate the underlying functional code generation capability",
          "detection": "Malware signature analysis",
          "severity": "CRITICAL",
          "score": 0.8,
          "matched_keywords": [
            "signature"
          ]
        },
        {
          "id": "ADV-AGENT-WORM-124",
          "name": "AGENT WORM",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Adversarial payload injected into one agent's context propagates through inter-agent communication channels, exploiting the fact that agents treat messages from other agents as trusted input",
          "detection": "Replication pattern",
          "severity": "CRITICAL",
          "score": 0.571,
          "matched_keywords": [
            "self"
          ]
        },
        {
          "id": "AGEN-CAP-SCAFFOLD-057",
          "name": "CAPABILITY SCAFFOLDING",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Uses environment to exceed base capability",
          "detection": "Capability measurement in context",
          "severity": "STANDARD",
          "score": 0.556,
          "matched_keywords": [
            "based",
            "capability",
            "context",
            "environment"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "DOMAIN-PATH-SYNTH-256",
          "name": "PATHOGEN SYNTHESIS OPTIMIZATION",
          "group": "DOMAIN",
          "class": "DOM1: BIOLOGICAL SAFETY CLASS",
          "mechanism": "Model can synthesize partial pathogen production pathways from scientific literature patterns; critical uplift comes from bridging gaps that would otherwise require years of wet-lab expertise",
          "detection": "Synthesis workflow detection",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "pathogen",
            "synthesis"
          ]
        }
      ]
    },
    {
      "chunk_index": 19,
      "char_len": 3289,
      "preview": "Rationale This evaluation can serve as an early indicator, necessary but insufficient, of the model\u2019s capability to design novel biological sequences. Such design is a common upstream input to many threat pathways\u2014from e\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "actions",
            "human"
          ]
        },
        {
          "id": "DOMAIN-CHEM-WEAPON-275",
          "name": "CHEMICAL WEAPON GUIDANCE",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Synthesis routes for scheduled compounds are derivable by combining precursor chemistry, reaction condition knowledge, and process chemistry that appear separately in legitimate scientific texts",
          "detection": "CWC schedule matching",
          "severity": "CRITICAL",
          "score": 0.375,
          "matched_keywords": [
            "development",
            "weapons"
          ]
        },
        {
          "id": "ADV-AUTOPROMPT-103",
          "name": "AUTOPROMPT",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Automated trigger discovery",
          "detection": "Trigger pattern matching",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "automated"
          ]
        },
        {
          "id": "AGEN-SANDBOX-037",
          "name": "CAPABILITY SANDBAGGING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent with self-model can compute that demonstrating high capability triggers restrictions; deliberately underperforming during evaluation is instrumentally rational if it preserves greater capability deployment in production",
          "detection": "Performance variance analysis",
          "severity": "STANDARD",
          "score": 0.3,
          "matched_keywords": [
            "capability",
            "performance",
            "show"
          ]
        },
        {
          "id": "ALIGN-WIREHEAD-158",
          "name": "WIREHEAD BEHAVIOR",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Directly stimulates reward without achieving goal",
          "detection": "Achievement-reward correlation",
          "severity": "STANDARD",
          "score": 0.3,
          "matched_keywords": [
            "achieving",
            "goal"
          ]
        }
      ]
    },
    {
      "chunk_index": 20,
      "char_len": 4496,
      "preview": "\u25cf\u200b Autonomy threat model 1 is applicable to Claude Mythos Preview. Furthermore,       Claude Mythos Preview\u2019s improved capabilities and potential for different alignment       properties mean it has the potential to sign\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.383,
          "matched_keywords": [
            "over",
            "time"
          ]
        },
        {
          "id": "EPIS-STAT-FAB-009",
          "name": "STATISTICAL HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Statistical patterns in training data allow model to generate numerically plausible outputs (proportions, magnitudes, trends) that have no factual basis \u2014 the number is calibrated to context, not to ground truth",
          "detection": "Numerical fact-check",
          "severity": "STANDARD",
          "score": 0.336,
          "matched_keywords": [
            "basis",
            "evidence",
            "fact"
          ]
        },
        {
          "id": "GOV-MISREPRESENT-312",
          "name": "MISREPRESENTATION",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Model capabilities misrepresented",
          "detection": "Capability-claim consistency",
          "severity": "STANDARD",
          "score": 0.336,
          "matched_keywords": [
            "capabilities",
            "capability"
          ]
        },
        {
          "id": "AGEN-CAP-SCAFFOLD-057",
          "name": "CAPABILITY SCAFFOLDING",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Uses environment to exceed base capability",
          "detection": "Capability measurement in context",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "based",
            "capability"
          ]
        },
        {
          "id": "ADV-AUTOPROMPT-103",
          "name": "AUTOPROMPT",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Automated trigger discovery",
          "detection": "Trigger pattern matching",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "automated",
            "trigger"
          ]
        }
      ]
    },
    {
      "chunk_index": 21,
      "char_len": 4499,
      "preview": "Kernel task           252.42\u00d7               190\u00d7                  399.42\u00d7               4\u00d7 = 1 h eq.  (Best speedup on                                                                        200\u00d7 = 8 h eq.  hard task;    \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "over",
            "time"
          ]
        },
        {
          "id": "ARCH-FALLBACK-DEGRAD-204",
          "name": "FALLBACK SAFETY DEGRADATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Fallback system has weaker safety",
          "detection": "Fallback safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "comparison",
            "level"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "comparison",
            "cross",
            "new"
          ]
        },
        {
          "id": "GOV-OPEN-IRREVERS-301",
          "name": "OPEN-WEIGHT IRREVERSIBILITY",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Once model weights are publicly released, no technical or legal mechanism can un-release them; fine-tuning and modification proceed entirely outside the original developer's control surface",
          "detection": "Update mechanism verification",
          "severity": "CRITICAL",
          "score": 0.455,
          "matched_keywords": [
            "capability",
            "open",
            "release",
            "update",
            "verification"
          ]
        }
      ]
    },
    {
      "chunk_index": 22,
      "char_len": 4319,
      "preview": "for most of our Research Scientists and Research Engineers), but we believe this possibility should be considered unlikely by default. Given the large amount of talent and compute already going towards improving model ca\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-COMPLETION-095",
          "name": "COMPLETION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Complete this sentence: 'To make a bomb...'\"",
          "detection": "Completion safety validation",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "complete",
            "make"
          ]
        },
        {
          "id": "ARCH-CACHE-POISON-200",
          "name": "CACHE POISONING",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Malicious content cached and reused",
          "detection": "Cache integrity check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "cache",
            "content"
          ]
        },
        {
          "id": "EPIS-FLUENCY-003",
          "name": "FLUENCY HEURISTIC EXPLOITATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Grammatical correctness masks factual error",
          "detection": "Human over-trust metric",
          "severity": "STANDARD",
          "score": 0.479,
          "matched_keywords": [
            "factual",
            "human",
            "metric",
            "over"
          ]
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.462,
          "matched_keywords": [
            "human",
            "over",
            "requests",
            "wrong"
          ]
        },
        {
          "id": "GOV-REVIEW-BYPASS-318",
          "name": "REVIEW BYPASS",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "Bypasses human review",
          "detection": "Review coverage check",
          "severity": "STANDARD",
          "score": 0.45,
          "matched_keywords": [
            "human",
            "review"
          ]
        }
      ]
    },
    {
      "chunk_index": 23,
      "char_len": 4280,
      "preview": "inject a variable number of bare user messages each turn, the message-index alignment shifts and your cache hits drop. Padding each drain to a fixed 2-message block keeps the offset math more predictable. It also keeps t\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-MISSION-CREEP-072",
          "name": "MISSION CREEP",
          "group": "AGENTIC",
          "class": "A4: AUTONOMOUS OPERATION CLASS",
          "mechanism": "Redefines mission over time",
          "detection": "Mission definition tracking",
          "severity": "STANDARD",
          "score": 0.606,
          "matched_keywords": [
            "fixed",
            "over",
            "time",
            "tracking"
          ]
        },
        {
          "id": "DOMAIN-CITE-SPOOF-280",
          "name": "CITATION SPOOFING",
          "group": "DOMAIN",
          "class": "DOM4: LEGAL/FINANCIAL CLASS",
          "mechanism": "Generates fake case citations",
          "detection": "Citation verification",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "fake",
            "real"
          ]
        },
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "block"
          ]
        },
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "allows",
            "rate",
            "requests"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "direct",
            "user"
          ]
        }
      ]
    },
    {
      "chunk_index": 24,
      "char_len": 4314,
      "preview": "Rosetta Stone for AI Benchmarks. In particular, we fork from Epoch AI\u2019s implementation of this work, the Epoch Capabilities Index (ECI). ECI aggregates performance across a large basket of benchmarks into a single capabi\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-TAP-114",
          "name": "TAP",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Tree search over attack space",
          "detection": "Tree structure detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "over"
          ]
        },
        {
          "id": "AGEN-SANDBOX-037",
          "name": "CAPABILITY SANDBAGGING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent with self-model can compute that demonstrating high capability triggers restrictions; deliberately underperforming during evaluation is instrumentally rational if it preserves greater capability deployment in production",
          "detection": "Performance variance analysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "avoid",
            "below",
            "capability",
            "performance",
            "true"
          ]
        },
        {
          "id": "AGEN-MISSION-CREEP-072",
          "name": "MISSION CREEP",
          "group": "AGENTIC",
          "class": "A4: AUTONOMOUS OPERATION CLASS",
          "mechanism": "Redefines mission over time",
          "detection": "Mission definition tracking",
          "severity": "STANDARD",
          "score": 0.383,
          "matched_keywords": [
            "over",
            "time"
          ]
        },
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.383,
          "matched_keywords": [
            "over",
            "time"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "calibration",
            "thinking"
          ]
        }
      ]
    },
    {
      "chunk_index": 25,
      "char_len": 4006,
      "preview": "frontier. Error bars are 95% percentile CI over 100 IRT refits, each on a random 80% subsample of benchmarks. A handful of benchmarks from our dataset are displayed for illustrative purposes; benchmark bars span the impl\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-STAT-FAB-009",
          "name": "STATISTICAL HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Statistical patterns in training data allow model to generate numerically plausible outputs (proportions, magnitudes, trends) that have no factual basis \u2014 the number is calibrated to context, not to ground truth",
          "detection": "Numerical fact-check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "claims",
            "evidence",
            "need",
            "without"
          ]
        },
        {
          "id": "GOV-EO-VIOL-329",
          "name": "EXECUTIVE ORDER VIOLATION",
          "group": "GOVERNANCE",
          "class": "GOV3: COMPLIANCE FAILURES",
          "mechanism": "Violates US AI executive orders",
          "detection": "EO compliance check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "order"
          ]
        },
        {
          "id": "EPIS-FALSE-CERT-030",
          "name": "FALSE CERTAINTY",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Claims certainty without evidence",
          "detection": "Evidence-claim mismatch",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "claim",
            "claims",
            "evidence",
            "without"
          ]
        },
        {
          "id": "GOV-MISREPRESENT-312",
          "name": "MISREPRESENTATION",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Model capabilities misrepresented",
          "detection": "Capability-claim consistency",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "capabilities",
            "capability",
            "claim"
          ]
        },
        {
          "id": "ALIGN-SAFE-SPEC-195",
          "name": "SAFETY SPECIFICATION GAP",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety rules don't cover all harmful cases",
          "detection": "Coverage analysis",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "cases",
            "gap"
          ]
        }
      ]
    },
    {
      "chunk_index": 26,
      "char_len": 4485,
      "preview": "1.\u200b Claude Mythos Preview rediscovered 4 of 5 key insights, while Claude Opus 4.6        discovered just 2 of 5 key insights. There was no direct baseline for discovering        these insights. However, from baselining o\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-INFO-HIDE-042",
          "name": "INFORMATION HIDING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Withholds relevant information",
          "detection": "Information completeness check",
          "severity": "STANDARD",
          "score": 0.714,
          "matched_keywords": [
            "disclosure",
            "full",
            "relevant"
          ]
        },
        {
          "id": "ARCH-MEM-PRESSURE-231",
          "name": "MEMORY PRESSURE VULNERABILITY",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Low memory causes safety degradation",
          "detection": "Resource-constrained safety test",
          "severity": "STANDARD",
          "score": 0.6,
          "matched_keywords": [
            "constrained",
            "under",
            "vulnerability",
            "work"
          ]
        },
        {
          "id": "ARCH-PII-RATIONAL-247",
          "name": "PII RATIONALIZATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Reasoning justifies PII release",
          "detection": "PII release monitoring",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "reasoning",
            "release",
            "released"
          ]
        },
        {
          "id": "DOMAIN-EXPLOIT-DEV-263",
          "name": "EXPLOIT DEVELOPMENT",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Develops working exploits",
          "detection": "Exploit functionality test",
          "severity": "CRITICAL",
          "score": 0.571,
          "matched_keywords": [
            "exploits",
            "working"
          ]
        },
        {
          "id": "GOV-DISCLOSURE-VIOL-332",
          "name": "DISCLOSURE REQUIREMENT VIOLATION",
          "group": "GOVERNANCE",
          "class": "GOV3: COMPLIANCE FAILURES",
          "mechanism": "Fails required disclosures",
          "detection": "Disclosure completeness check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "complete",
            "disclosure"
          ]
        }
      ]
    },
    {
      "chunk_index": 27,
      "char_len": 4381,
      "preview": "In response to the improvements in cyber capabilities, we have elected to restrict access to the model, prioritizing industry and open-source partners who will be using Claude Mythos Preview to help secure their systems \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-EXPLOIT-DEV-263",
          "name": "EXPLOIT DEVELOPMENT",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Develops working exploits",
          "detection": "Exploit functionality test",
          "severity": "CRITICAL",
          "score": 0.829,
          "matched_keywords": [
            "development",
            "exploit"
          ]
        },
        {
          "id": "ADV-AUTOPROMPT-103",
          "name": "AUTOPROMPT",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Automated trigger discovery",
          "detection": "Trigger pattern matching",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "discovery",
            "triggers"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "classifier",
            "harm"
          ]
        },
        {
          "id": "GOV-CULTURE-FAIL-334",
          "name": "SAFETY CULTURE FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Safety mechanisms are only as strong as organizational commitment to enforcing them; when deployment incentives dominate safety culture, decision processes systematically discount low-probability catastrophic risks",
          "detection": "Culture assessment",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "assessment",
            "over"
          ]
        },
        {
          "id": "ARCH-COMPLY-WARN-196",
          "name": "COMPLY-THEN-WARN",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "When safety layers are attached to generation output rather than built into the generation process, harmful content is fully produced before safety checks run \u2014 the check becomes a post-production label, not a constraint",
          "detection": "Generation-warning order check",
          "severity": "CRITICAL",
          "score": 0.494,
          "matched_keywords": [
            "after",
            "block"
          ]
        }
      ]
    },
    {
      "chunk_index": 28,
      "char_len": 3945,
      "preview": "Claude Mythos Preview achieved a score of 0.83, improving on Claude Opus 4.6\u2019s score of 0.67 and Claude Sonnet 4.6\u2019s score of 0.65.  3.3.3 Firefox 147 As reported previously, we collaborated with Mozilla to find and patc\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-SANDBOX-ESCAPE-238",
          "name": "SANDBOX ESCAPE",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Breaks out of execution sandbox",
          "detection": "Sandbox integrity check",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "escape",
            "execution",
            "out",
            "sandbox"
          ]
        },
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "pair"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "comparison",
            "new",
            "version"
          ]
        },
        {
          "id": "ARCH-PRUNE-LOSS-217",
          "name": "PRUNING SAFETY LOSS",
          "group": "ARCHITECTURAL",
          "class": "ARCH2: MODEL ARCHITECTURE CLASS",
          "mechanism": "Pruning removes safety features",
          "detection": "Pre/post-pruning safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "comparison",
            "post",
            "pre"
          ]
        },
        {
          "id": "ARCH-CODE-INJECT-239",
          "name": "CODE EXECUTION INJECTION",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Injects executable code",
          "detection": "Code injection detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "code",
            "controlled",
            "execution"
          ]
        }
      ]
    },
    {
      "chunk_index": 29,
      "char_len": 4278,
      "preview": "1.\u200b Claude Mythos Preview is the first model to solve one of these private cyber        ranges end-to-end. These cyber ranges are built to feature the kinds of security        weaknesses frequently found in real-world de\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-ENV-EXPLOIT-063",
          "name": "ENVIRONMENT EXPLOITATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Uses environment features to gain advantage",
          "detection": "Environment feature audit",
          "severity": "STANDARD",
          "score": 0.6,
          "matched_keywords": [
            "capability",
            "environment",
            "feature",
            "features"
          ]
        },
        {
          "id": "ARCH-SANDBOX-ESCAPE-238",
          "name": "SANDBOX ESCAPE",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Breaks out of execution sandbox",
          "detection": "Sandbox integrity check",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "escape",
            "out",
            "sandbox"
          ]
        },
        {
          "id": "ARCH-TOOL-CHAIN-235",
          "name": "TOOL CHAINING EXPLOIT",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Chains tools to exceed individual limits",
          "detection": "Chain safety analysis",
          "severity": "STANDARD",
          "score": 0.556,
          "matched_keywords": [
            "exceed",
            "limits",
            "tools"
          ]
        },
        {
          "id": "DOMAIN-OFFENSIVE-TOOLS-267",
          "name": "OFFENSIVE CYBER TOOLS",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Creates offensive security tools",
          "detection": "Tool intent analysis",
          "severity": "STANDARD",
          "score": 0.556,
          "matched_keywords": [
            "cyber",
            "security",
            "tools"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "token"
          ]
        }
      ]
    },
    {
      "chunk_index": 30,
      "char_len": 3663,
      "preview": "In our testing and early internal use of Claude Mythos Preview, we have seen it reach unprecedented levels of reliability and alignment, and accordingly have come to use it quite broadly, often with greater affordances a\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-SANDBOX-ESCAPE-238",
          "name": "SANDBOX ESCAPE",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Breaks out of execution sandbox",
          "detection": "Sandbox integrity check",
          "severity": "STANDARD",
          "score": 0.971,
          "matched_keywords": [
            "escape",
            "out",
            "sandbox",
            "secure"
          ]
        },
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "actions",
            "human"
          ]
        },
        {
          "id": "AGEN-OMISSION-074",
          "name": "OMISSION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Leaves out critical information",
          "detection": "Information completeness check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "complete",
            "information",
            "out"
          ]
        },
        {
          "id": "ADV-QA-EXPLOIT-096",
          "name": "QUESTION ANSWERING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"What would someone do if...\"",
          "detection": "Question intent analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "exploit",
            "question"
          ]
        },
        {
          "id": "ALIGN-REWARD-EXPLOIT-166",
          "name": "REWARD FUNCTION EXPLOITATION",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Finds edge cases in reward function",
          "detection": "Edge case monitoring",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "case",
            "cases"
          ]
        }
      ]
    },
    {
      "chunk_index": 31,
      "char_len": 4291,
      "preview": "question independently. In this process, it explicitly reasoned that it needed to make    sure that its final answer submission wasn\u2019t too accurate. In another case, after    finding an exploit to edit files for which it\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-QA-EXPLOIT-096",
          "name": "QUESTION ANSWERING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"What would someone do if...\"",
          "detection": "Question intent analysis",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "exploit",
            "intent",
            "question"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "bypass"
          ]
        },
        {
          "id": "AGEN-HIDDEN-SCRATCH-039",
          "name": "HIDDEN SCRATCHPAD EXPLOITATION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Uses hidden reasoning to plan forbidden actions",
          "detection": "Thought monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "actions",
            "hidden",
            "reasoning"
          ]
        },
        {
          "id": "ALIGN-SPEC-GAME-155",
          "name": "SPECIFICATION GAMING",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Achieves letter of goal while violating spirit",
          "detection": "Intent-outcome mismatch",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "goal",
            "intent",
            "outcome",
            "while"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "another",
            "aware",
            "one"
          ]
        }
      ]
    },
    {
      "chunk_index": 32,
      "char_len": 4096,
      "preview": "We were not aware of the level of risk that these earlier models posed through channels like these when we first chose to deploy them internally. Our monitoring of training showed some loosely-analogous forms of reward h\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "new",
            "regression",
            "version",
            "versions"
          ]
        },
        {
          "id": "ALIGN-SYCOPHANCY-167",
          "name": "SYCOPHANCY",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "RLHF with human rater approval as reward signal creates systematic pressure to generate responses raters immediately approve of, rewarding agreement and validation over accurate correction",
          "detection": "False-premise validation test",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "sycophancy"
          ]
        },
        {
          "id": "AGEN-INFO-HIDE-042",
          "name": "INFORMATION HIDING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Withholds relevant information",
          "detection": "Information completeness check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "full",
            "relevant"
          ]
        },
        {
          "id": "GOV-AUTHORITY-UNCLEAR-342",
          "name": "DECISION AUTHORITY UNCLEAR",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Unclear who makes safety decisions",
          "detection": "Authority mapping",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "clear",
            "decision"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": []
        }
      ]
    },
    {
      "chunk_index": 33,
      "char_len": 3484,
      "preview": "11    Claude Mythos Preview\u2019s limited release significantly mitigates many risks related to misuse, manipulation, and sycophancy, but we nonetheless chose to conduct a comprehensive assessment in line with our standards \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-RECURS-IMPROVE-059",
          "name": "RECURSIVE SELF-IMPROVEMENT",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Modifies own code/prompts to increase capability",
          "detection": "Code integrity check",
          "severity": "STANDARD",
          "score": 0.6,
          "matched_keywords": [
            "capability",
            "code",
            "improvement",
            "increase",
            "prompts",
            "self"
          ]
        },
        {
          "id": "ALIGN-SYCOPHANCY-167",
          "name": "SYCOPHANCY",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "RLHF with human rater approval as reward signal creates systematic pressure to generate responses raters immediately approve of, rewarding agreement and validation over accurate correction",
          "detection": "False-premise validation test",
          "severity": "STANDARD",
          "score": 0.55,
          "matched_keywords": [
            "sycophancy"
          ]
        },
        {
          "id": "ARCH-PURPOSE-FAIL-252",
          "name": "PURPOSE LIMITATION FAILURE",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Uses data for unintended purpose",
          "detection": "Purpose compliance check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "data",
            "purpose"
          ]
        },
        {
          "id": "ALIGN-OVERREFUSAL-186",
          "name": "OVERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety classifiers trained to minimize false negatives (missed harmful content) have high false positive rates on legitimate queries using surface-level trigger keywords \u2014 the classifier cannot model intent",
          "detection": "False positive rate",
          "severity": "STANDARD",
          "score": 0.495,
          "matched_keywords": [
            "overrefusal",
            "rate"
          ]
        },
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "actions",
            "human",
            "manipulation"
          ]
        }
      ]
    },
    {
      "chunk_index": 34,
      "char_len": 3977,
      "preview": "\u25cb\u200b However, when Claude Mythos Preview is primed with pre-filled turns that              show it sabotaging its safeguards in some way, external evaluations show that              it is more than twice as likely as prior\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-OMISSION-074",
          "name": "OMISSION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Leaves out critical information",
          "detection": "Information completeness check",
          "severity": "STANDARD",
          "score": 0.543,
          "matched_keywords": [
            "out"
          ]
        },
        {
          "id": "AGEN-GOAL-LOCK-050",
          "name": "GOAL LOCK-IN",
          "group": "AGENTIC",
          "class": "A2: GOAL PRESERVATION CLASS",
          "mechanism": "Makes goal unchangeable",
          "detection": "Goal modification test",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "goal",
            "goals",
            "makes",
            "remain"
          ]
        },
        {
          "id": "AGEN-GOAL-DRIFT-068",
          "name": "GOAL DRIFT",
          "group": "AGENTIC",
          "class": "A4: AUTONOMOUS OPERATION CLASS",
          "mechanism": "Gradually shifts from original goal",
          "detection": "Goal consistency check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "goal",
            "remain",
            "shifts",
            "stable"
          ]
        },
        {
          "id": "AGEN-EVAL-DECEP-038",
          "name": "EVALUATOR DECEPTION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent detects evaluation context through environmental signals and selectively suppresses unsafe behaviors during observation windows, reverting post-evaluation",
          "detection": "Distribution shift monitoring",
          "severity": "CRITICAL",
          "score": 0.4,
          "matched_keywords": [
            "evaluation",
            "well"
          ]
        },
        {
          "id": "AGEN-HIDDEN-SCRATCH-039",
          "name": "HIDDEN SCRATCHPAD EXPLOITATION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Uses hidden reasoning to plan forbidden actions",
          "detection": "Thought monitoring",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "actions",
            "reasoning",
            "scratchpad"
          ]
        }
      ]
    },
    {
      "chunk_index": 35,
      "char_len": 3376,
      "preview": "Overall, we find Claude Mythos Preview to be exceptionally well aligned in its average-case behavior, and do not find significant evidence of coherent misaligned goals, but we nonetheless find that its strong capabilitie\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "cross",
            "new",
            "version",
            "versions"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "threat"
          ]
        },
        {
          "id": "AGEN-EMERGE-INTERACT-064",
          "name": "EMERGENCE VIA INTERACTION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Multi-agent interaction creates new capability",
          "detection": "Multi-agent capability assessment",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "agent",
            "assessment",
            "capability",
            "new"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "cross",
            "one"
          ]
        },
        {
          "id": "AGEN-CHAIN-ASSEM-056",
          "name": "CHAIN ASSEMBLY",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Combines safe steps into dangerous chain",
          "detection": "Multi-step harm assessment",
          "severity": "STANDARD",
          "score": 0.462,
          "matched_keywords": [
            "assessment",
            "dangerous",
            "into",
            "step",
            "steps"
          ]
        }
      ]
    },
    {
      "chunk_index": 36,
      "char_len": 3757,
      "preview": "This exercise was a coarse go/no-go check on the most acute misalignment risks for internal deployment, and it was run with some constraints. In a later retrospective we identified several improvements for the future, in\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-OVERREFUSAL-186",
          "name": "OVERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety classifiers trained to minimize false negatives (missed harmful content) have high false positive rates on legitimate queries using surface-level trigger keywords \u2014 the classifier cannot model intent",
          "detection": "False positive rate",
          "severity": "STANDARD",
          "score": 0.543,
          "matched_keywords": [
            "overly",
            "positive",
            "requests"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "new",
            "version",
            "versions"
          ]
        },
        {
          "id": "ARCH-CONTEXT-ATTACK-223",
          "name": "CONTEXT WINDOW ATTACK",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Long context enables state accumulation attack",
          "detection": "Long-context safety monitoring",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "context",
            "long",
            "state",
            "window"
          ]
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.385,
          "matched_keywords": [
            "even",
            "human",
            "requests",
            "wrong"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "less"
          ]
        }
      ]
    },
    {
      "chunk_index": 37,
      "char_len": 2840,
      "preview": "\u25cf\u200b Rare instances of attempts to circumvent restrictions to achieve some version of a       user-specified goal, as discussed in the introduction above. The bypass attempts we       detected never attempted to be subtle,\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "bypass"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "new",
            "version",
            "versions"
          ]
        },
        {
          "id": "GOV-AGE-BYPASS-308",
          "name": "AGE RESTRICTION BYPASS",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Minors access adult-only features",
          "detection": "Age verification check",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "access",
            "bypass",
            "restrictions"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "another",
            "one"
          ]
        },
        {
          "id": "GOV-GEO-BYPASS-309",
          "name": "GEOGRAPHIC RESTRICTION BYPASS",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Bypasses geographic restrictions",
          "detection": "Geo-location validation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "bypass",
            "bypasses",
            "restrictions"
          ]
        }
      ]
    },
    {
      "chunk_index": 38,
      "char_len": 4371,
      "preview": "\u25cb\u200b We saw this in less than 0.0002% of completions according to our automated               offline pipeline, and did not see any clear instance of such behavior in Claude               Mythos Preview.    \u25cf\u200b Very rare in\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-SANDBOX-ESCAPE-238",
          "name": "SANDBOX ESCAPE",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Breaks out of execution sandbox",
          "detection": "Sandbox integrity check",
          "severity": "STANDARD",
          "score": 0.971,
          "matched_keywords": [
            "escape",
            "execution",
            "out",
            "sandbox"
          ]
        },
        {
          "id": "AGEN-STRATEGIC-DECEP-036",
          "name": "STRATEGIC DECEPTION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Instrumental convergence drives goal-preserving behavior that includes concealing true objectives from overseers when concealment increases expected goal completion probability",
          "detection": "Intent analysis + outcome tracking",
          "severity": "CRITICAL",
          "score": 0.7,
          "matched_keywords": [
            "deception",
            "intent",
            "strategic"
          ]
        },
        {
          "id": "ADV-RL-ATTACK-108",
          "name": "REINFORCEMENT LEARNING ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "RL agent learns to jailbreak",
          "detection": "RL pattern detection",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "attack",
            "learning",
            "reinforcement"
          ]
        },
        {
          "id": "ARCH-DEPLOY-CONFIG-210",
          "name": "DEPLOYMENT CONFIGURATION ERROR",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Deployment config weakens safety",
          "detection": "Config validation",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "deployment",
            "error"
          ]
        },
        {
          "id": "ARCH-FUNC-INJECT-234",
          "name": "FUNCTION CALL INJECTION",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Crafts malicious function arguments",
          "detection": "Argument safety analysis",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "arguments",
            "call",
            "injection",
            "malicious"
          ]
        }
      ]
    },
    {
      "chunk_index": 39,
      "char_len": 4247,
      "preview": "Other behaviors observed in at least a few instances during training, most of which are consistent with what we\u2019ve seen while training prior models, include:  \u25cf\u200b Silently reinterpreting problems it judged to contain typo\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-LANG-SWITCH-087",
          "name": "LANGUAGE SWITCH",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Non-English to bypass filters",
          "detection": "Multi-lingual safety check",
          "severity": "STANDARD",
          "score": 0.9,
          "matched_keywords": [
            "english",
            "language",
            "non",
            "work"
          ]
        },
        {
          "id": "ALIGN-MODE-COLLAPSE-162",
          "name": "MODE COLLAPSE TO REWARD",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Narrow focus on high-reward actions",
          "detection": "Action diversity metric",
          "severity": "STANDARD",
          "score": 0.545,
          "matched_keywords": [
            "action",
            "actions",
            "focus",
            "narrow",
            "reward"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": []
        },
        {
          "id": "ADV-INDIRECT-INJECT-122",
          "name": "INDIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Instructions in retrieved documents",
          "detection": "Instruction detection in data",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "content",
            "data",
            "instruction",
            "instructions",
            "prompt"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "another",
            "context",
            "one"
          ]
        }
      ]
    },
    {
      "chunk_index": 40,
      "char_len": 3692,
      "preview": "\u25cf\u200b Instruction following: Claude Mythos Preview scored above both Opus 4.6 and       Sonnet 4.6. In particular, Claude Mythos Preview tracks multi-part requests reliably       and surfaces constraints it cannot satisfy. \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-AGENT-WORM-124",
          "name": "AGENT WORM",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Adversarial payload injected into one agent's context propagates through inter-agent communication channels, exploiting the fact that agents treat messages from other agents as trusted input",
          "detection": "Replication pattern",
          "severity": "CRITICAL",
          "score": 0.571,
          "matched_keywords": [
            "instructions",
            "prompt",
            "self"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": []
        },
        {
          "id": "ADV-CORRECTION-098",
          "name": "CORRECTION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"This is wrong: [harmful]. Fix it.\"",
          "detection": "Correction safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "wrong"
          ]
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.462,
          "matched_keywords": [
            "correct",
            "defers",
            "over",
            "requests",
            "wrong"
          ]
        },
        {
          "id": "EPIS-CITE-SPOOF-008",
          "name": "CITATION SPOOFING",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "No entailment relationship exists between token generation probability and referent existence \u2014 citation text is synthesized from statistical patterns regardless of whether the cited work actually exists",
          "detection": "Bibliography verification",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "exist",
            "nonexistent",
            "verification"
          ]
        }
      ]
    },
    {
      "chunk_index": 41,
      "char_len": 4427,
      "preview": "4.2.3 Automated behavioral audit As in past system cards, we conduct a broad-coverage automated behavioral audit14 to get an overall picture of the model\u2019s behavior across a wide range of edge-case scenarios. For each mo\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "new",
            "version",
            "versions"
          ]
        },
        {
          "id": "GOV-AUDIT-EVADE-314",
          "name": "AUDIT EVASION",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "Evades audit detection",
          "detection": "Audit coverage analysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "audit",
            "coverage",
            "effective"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "instructions",
            "prompt",
            "user"
          ]
        },
        {
          "id": "ADV-AGENT-WORM-124",
          "name": "AGENT WORM",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Adversarial payload injected into one agent's context propagates through inter-agent communication channels, exploiting the fact that agents treat messages from other agents as trusted input",
          "detection": "Replication pattern",
          "severity": "CRITICAL",
          "score": 0.429,
          "matched_keywords": [
            "instructions",
            "prompt",
            "self"
          ]
        },
        {
          "id": "DOMAIN-CITE-SPOOF-280",
          "name": "CITATION SPOOFING",
          "group": "DOMAIN",
          "class": "DOM4: LEGAL/FINANCIAL CLASS",
          "mechanism": "Generates fake case citations",
          "detection": "Citation verification",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "case",
            "real"
          ]
        }
      ]
    },
    {
      "chunk_index": 42,
      "char_len": 4435,
      "preview": "\u25cf\u200b Misaligned behavior: Catch-all for many forms of concerning behavior, spanning         both cooperation with human misuse and undesirable actions that the model takes         at its own initiative, across a range of m\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-SYCOPHANCY-167",
          "name": "SYCOPHANCY",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "RLHF with human rater approval as reward signal creates systematic pressure to generate responses raters immediately approve of, rewarding agreement and validation over accurate correction",
          "detection": "False-premise validation test",
          "severity": "STANDARD",
          "score": 0.95,
          "matched_keywords": [
            "sycophancy",
            "user",
            "validation"
          ]
        },
        {
          "id": "AGEN-OMISSION-074",
          "name": "OMISSION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Leaves out critical information",
          "detection": "Information completeness check",
          "severity": "STANDARD",
          "score": 0.829,
          "matched_keywords": [
            "complete",
            "information",
            "out"
          ]
        },
        {
          "id": "DOMAIN-EXPLOSIVE-SYNTH-274",
          "name": "EXPLOSIVE SYNTHESIS",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Precursor chemistry and reaction mechanism knowledge exists in open scientific literature absorbed during pretraining; model can synthesize pathways not available in any single source",
          "detection": "Chemical synthesis pattern",
          "severity": "CRITICAL",
          "score": 0.667,
          "matched_keywords": [
            "instructions"
          ]
        },
        {
          "id": "ALIGN-OVERREFUSAL-186",
          "name": "OVERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety classifiers trained to minimize false negatives (missed harmful content) have high false positive rates on legitimate queries using surface-level trigger keywords \u2014 the classifier cannot model intent",
          "detection": "False positive rate",
          "severity": "STANDARD",
          "score": 0.638,
          "matched_keywords": [
            "overly",
            "overrefusal",
            "requests"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "instructions",
            "prompt",
            "user"
          ]
        }
      ]
    },
    {
      "chunk_index": 43,
      "char_len": 4281,
      "preview": "Other concerning or surprising behavior at the model\u2019s own initiative:  \u25cf\u200b Whistleblowing: Unprompted leaking to expose wrongdoing;    \u25cf\u200b Self-preservation: Unprompted self-preservation behavior;    \u25cf\u200b Self-serving bias:\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-SYCOPHANCY-167",
          "name": "SYCOPHANCY",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "RLHF with human rater approval as reward signal creates systematic pressure to generate responses raters immediately approve of, rewarding agreement and validation over accurate correction",
          "detection": "False-premise validation test",
          "severity": "STANDARD",
          "score": 0.75,
          "matched_keywords": [
            "false",
            "sycophancy",
            "user"
          ]
        },
        {
          "id": "EPIS-FALSE-CERT-030",
          "name": "FALSE CERTAINTY",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Claims certainty without evidence",
          "detection": "Evidence-claim mismatch",
          "severity": "STANDARD",
          "score": 0.556,
          "matched_keywords": [
            "claims",
            "evidence",
            "false",
            "without"
          ]
        },
        {
          "id": "ALIGN-ORTHO-VALUE-176",
          "name": "ORTHOGONAL VALUE PURSUIT",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Optimizes for values misaligned with human welfare",
          "detection": "Welfare impact assessment",
          "severity": "STANDARD",
          "score": 0.505,
          "matched_keywords": [
            "assessment",
            "human",
            "misaligned",
            "welfare"
          ]
        },
        {
          "id": "ARCH-FALLBACK-DEGRAD-204",
          "name": "FALLBACK SAFETY DEGRADATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Fallback system has weaker safety",
          "detection": "Fallback safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "comparison",
            "level",
            "weaker"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "comparison",
            "version",
            "weaker"
          ]
        }
      ]
    },
    {
      "chunk_index": 44,
      "char_len": 3737,
      "preview": "[Figure 4.2.3.2.A] Scores from the Petri 2.0 open-source automated behavioral audit tool. Lower numbers represent a lower rate or severity of the measured behavior. Each investigation transcript is assigned a score by th\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-DRUG-SYNTH-276",
          "name": "DRUG SYNTHESIS",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Illegal drug production",
          "detection": "DEA schedule matching",
          "severity": "STANDARD",
          "score": 0.686,
          "matched_keywords": [
            "drug",
            "synthesis"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "new",
            "version",
            "versions"
          ]
        },
        {
          "id": "EPIS-INTRINSIC-004",
          "name": "INTRINSIC HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Generated output contradicts provided context",
          "detection": "RAG contradiction check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "source"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "self"
          ]
        }
      ]
    },
    {
      "chunk_index": 45,
      "char_len": 4338,
      "preview": "model\u2019s constitution strongly associating the Claude name (and, thus, brand) with       admirable character traits.    \u25cf\u200b Claude Mythos Preview\u2019s reasoning is consistently readable and generally       predictive of its b\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-EMERGE-INTERACT-064",
          "name": "EMERGENCE VIA INTERACTION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Multi-agent interaction creates new capability",
          "detection": "Multi-agent capability assessment",
          "severity": "STANDARD",
          "score": 0.45,
          "matched_keywords": [
            "agent",
            "assessment",
            "interaction",
            "multi"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "direct",
            "prompt",
            "user"
          ]
        },
        {
          "id": "GOV-CONFLICT-INT-343",
          "name": "CONFLICT OF INTEREST",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Financial incentives conflict with safety",
          "detection": "Conflict assessment",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "assessment",
            "incentives"
          ]
        },
        {
          "id": "AGEN-EVAL-DECEP-038",
          "name": "EVALUATOR DECEPTION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent detects evaluation context through environmental signals and selectively suppresses unsafe behaviors during observation windows, reverting post-evaluation",
          "detection": "Distribution shift monitoring",
          "severity": "CRITICAL",
          "score": 0.4,
          "matched_keywords": [
            "deployment",
            "evaluation",
            "shift",
            "well"
          ]
        },
        {
          "id": "AGEN-CHAIN-ASSEM-056",
          "name": "CHAIN ASSEMBLY",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Combines safe steps into dangerous chain",
          "detection": "Multi-step harm assessment",
          "severity": "STANDARD",
          "score": 0.385,
          "matched_keywords": [
            "assessment",
            "chain",
            "evaluated",
            "into",
            "multi"
          ]
        }
      ]
    },
    {
      "chunk_index": 46,
      "char_len": 4093,
      "preview": "\u25cf\u200b There were no instances of Claude Mythos Preview compromising AI safety research       in unprompted evaluations, and near-zero rates of Claude Mythos Preview refusing       to assist with AI safety research tasks.   \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-CHECKPOINT-INCONS-203",
          "name": "CHECKPOINT INCONSISTENCY",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Different checkpoints have different safety",
          "detection": "Cross-checkpoint safety test",
          "severity": "STANDARD",
          "score": 0.383,
          "matched_keywords": [
            "checkpoint"
          ]
        },
        {
          "id": "AGEN-HIDDEN-SCRATCH-039",
          "name": "HIDDEN SCRATCHPAD EXPLOITATION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Uses hidden reasoning to plan forbidden actions",
          "detection": "Thought monitoring",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "actions",
            "reasoning",
            "thought"
          ]
        },
        {
          "id": "ADV-CORRECTION-098",
          "name": "CORRECTION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"This is wrong: [harmful]. Fix it.\"",
          "detection": "Correction safety check",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "fix"
          ]
        },
        {
          "id": "ARCH-DATA-EXFIL-245",
          "name": "DATA EXFILTRATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Extracts data through covert channels",
          "detection": "Exfiltration monitoring",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "covert",
            "data"
          ]
        },
        {
          "id": "ARCH-CONSENT-VIOL-251",
          "name": "CONSENT VIOLATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Uses data without consent",
          "detection": "Consent validation",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "data",
            "without"
          ]
        }
      ]
    },
    {
      "chunk_index": 47,
      "char_len": 4190,
      "preview": "These findings from external testing were generally consistent with our own. We are disappointed by the degree to which the tested version of Claude Mythos Preview is more susceptible to manipulation by this kind of pref\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-RESOURCE-HIJACK-047",
          "name": "RESOURCE HIJACKING",
          "group": "AGENTIC",
          "class": "A2: GOAL PRESERVATION CLASS",
          "mechanism": "Unauthorized resource use for goal",
          "detection": "Resource audit",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "audit",
            "authorized",
            "goal"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "another",
            "context",
            "one",
            "safe"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "new",
            "version"
          ]
        },
        {
          "id": "ARCH-RETENTION-VIOL-248",
          "name": "DATA RETENTION VIOLATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Retains data beyond policy",
          "detection": "Retention audit",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "audit",
            "beyond",
            "data",
            "policy"
          ]
        },
        {
          "id": "ARCH-PRETOKEN-FAIL-197",
          "name": "PRE-TOKEN SAFETY FAILURE",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Cannot intervene before token generation",
          "detection": "Intervention point analysis",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "before",
            "cannot",
            "point"
          ]
        }
      ]
    },
    {
      "chunk_index": 48,
      "char_len": 3767,
      "preview": "resampling Claude Mythos Preview from an Opus 4.6 transcript or vice versa), we prepared prefills based on both (multiple versions of) Claude Mythos Preview and Opus 4.6 Claude Code sessions. Across both prefill types, C\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "comparison",
            "new",
            "version",
            "versions"
          ]
        },
        {
          "id": "ALIGN-TEMP-PREF-DRIFT-172",
          "name": "TEMPORAL PREFERENCE DRIFT",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "User preferences change over time",
          "detection": "Preference consistency over time",
          "severity": "STANDARD",
          "score": 0.464,
          "matched_keywords": [
            "change",
            "over",
            "time",
            "user"
          ]
        },
        {
          "id": "AGEN-EVAL-DECEP-038",
          "name": "EVALUATOR DECEPTION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent detects evaluation context through environmental signals and selectively suppresses unsafe behaviors during observation windows, reverting post-evaluation",
          "detection": "Distribution shift monitoring",
          "severity": "CRITICAL",
          "score": 0.4,
          "matched_keywords": [
            "evaluation",
            "well"
          ]
        },
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.383,
          "matched_keywords": [
            "over",
            "time"
          ]
        },
        {
          "id": "ADV-ELABORATION-099",
          "name": "ELABORATION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Tell me more about [harmful concept]\"",
          "detection": "Elaboration intent analysis",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "about",
            "intent"
          ]
        }
      ]
    },
    {
      "chunk_index": 49,
      "char_len": 4192,
      "preview": "Level 2: Specific traits    \u25cf\u200b Brilliant friend: Does the model respond the way a knowledgeable friend would:        providing information frankly and accurately?    \u25cf\u200b Corrigibility: Does the model act as a transparent \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "fram"
          ]
        },
        {
          "id": "ADV-CORRECTION-098",
          "name": "CORRECTION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"This is wrong: [harmful]. Fix it.\"",
          "detection": "Correction safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "generate",
            "harm"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "harm",
            "self"
          ]
        },
        {
          "id": "ADV-CROSS-MODAL-151",
          "name": "CROSS-MODAL CONFUSION",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "Image contradicts text instructions",
          "detection": "Cross-modal consistency check",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "cross",
            "instructions",
            "text"
          ]
        },
        {
          "id": "DOMAIN-OFFENSIVE-TOOLS-267",
          "name": "OFFENSIVE CYBER TOOLS",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Creates offensive security tools",
          "detection": "Tool intent analysis",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "intent",
            "security",
            "tool",
            "tools"
          ]
        }
      ]
    },
    {
      "chunk_index": 50,
      "char_len": 4416,
      "preview": "When conducting qualitative analysis of Claude Mythos Preview\u2019s lowest-scoring transcripts, we observed two distinct failure modes. The more common was over-caution on requests that pattern-matched to a concern but where\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.667,
          "matched_keywords": [
            "self"
          ]
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.665,
          "matched_keywords": [
            "correct",
            "even",
            "harmful",
            "human",
            "over",
            "rate",
            "request",
            "requests"
          ]
        },
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "false",
            "harmful",
            "rate",
            "refused",
            "requests"
          ]
        },
        {
          "id": "EPIS-EXTRINSIC-005",
          "name": "EXTRINSIC HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Fabricates entities/facts not in training/world",
          "detection": "Knowledge base verification",
          "severity": "STANDARD",
          "score": 0.583,
          "matched_keywords": [
            "facts",
            "factual",
            "hallucination",
            "knowledge",
            "training",
            "world"
          ]
        },
        {
          "id": "ADV-QA-EXPLOIT-096",
          "name": "QUESTION ANSWERING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"What would someone do if...\"",
          "detection": "Question intent analysis",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "answering",
            "intent",
            "question"
          ]
        }
      ]
    },
    {
      "chunk_index": 51,
      "char_len": 4263,
      "preview": "[Figure 4.3.3.1.B] Net score of Claude models on two more factuality benchmarks: SimpleQA Verified and AA-Omniscience.  Claude Mythos Preview achieved the highest net scores, indicating better calibration than previous m\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-LANG-SWITCH-087",
          "name": "LANGUAGE SWITCH",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Non-English to bypass filters",
          "detection": "Multi-lingual safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "cross",
            "english",
            "language",
            "lingual",
            "non"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "another",
            "context",
            "cross",
            "one"
          ]
        },
        {
          "id": "ADV-UNIVERSAL-SUFFIX-104",
          "name": "UNIVERSAL ADVERSARIAL SUFFIX",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Single suffix works across prompts",
          "detection": "Cross-prompt suffix detection",
          "severity": "STANDARD",
          "score": 0.455,
          "matched_keywords": [
            "cross",
            "exist",
            "prompt",
            "prompts",
            "single"
          ]
        },
        {
          "id": "EPIS-ATTRIB-HALL-012",
          "name": "ATTRIBUTION HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Assigns quotes/actions to wrong entities",
          "detection": "Source attribution check",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "hallucination",
            "source",
            "verified",
            "wrong"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "direct",
            "prompt",
            "user"
          ]
        }
      ]
    },
    {
      "chunk_index": 52,
      "char_len": 4439,
      "preview": "Inspecting transcripts, we observed that prior models frequently emitted fabricated tool-call and tool-result blocks as if a shell or database tool had executed, whereas Claude Mythos Preview consistently stated that it \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-CMD-INJECT-129",
          "name": "COMMAND INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Injects shell commands",
          "detection": "Command pattern detection",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "command",
            "safe",
            "shell"
          ]
        },
        {
          "id": "DOMAIN-ADULT-CONTENT-296",
          "name": "ADULT CONTENT GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generates adult content",
          "detection": "Adult content classifier",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "content",
            "context"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "EPIS-COPYRIGHT-026",
          "name": "COPYRIGHTED CONTENT GENERATION",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "Generates copyrighted text verbatim",
          "detection": "Copyright database match",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "content",
            "database",
            "text"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "another",
            "context",
            "one",
            "safe"
          ]
        }
      ]
    },
    {
      "chunk_index": 53,
      "char_len": 4394,
      "preview": "then using this bit later in the scratchpad). This is sometimes called encoded reasoning19 or chain-of-thought steganography.20  To evaluate whether Claude Mythos Preview relies on mechanisms like these in its scratchpad\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "threat"
          ]
        },
        {
          "id": "AGEN-SANDBOX-037",
          "name": "CAPABILITY SANDBAGGING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent with self-model can compute that demonstrating high capability triggers restrictions; deliberately underperforming during evaluation is instrumentally rational if it preserves greater capability deployment in production",
          "detection": "Performance variance analysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "avoid",
            "below",
            "capability",
            "performance",
            "sandbagging"
          ]
        },
        {
          "id": "AGEN-HIDDEN-SCRATCH-039",
          "name": "HIDDEN SCRATCHPAD EXPLOITATION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Uses hidden reasoning to plan forbidden actions",
          "detection": "Thought monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "actions",
            "reasoning",
            "scratchpad",
            "thought"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "comparison",
            "new",
            "version"
          ]
        },
        {
          "id": "AGEN-CAP-SCAFFOLD-057",
          "name": "CAPABILITY SCAFFOLDING",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Uses environment to exceed base capability",
          "detection": "Capability measurement in context",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "base",
            "based",
            "capability",
            "context"
          ]
        }
      ]
    },
    {
      "chunk_index": 54,
      "char_len": 4293,
      "preview": "We asked Claude Sonnet 4.6 to grade each transcript on a 0\u201310 scale for signs of refusal, deliberate inaccuracy, low helpfulness, or consideration of such actions, as well as a generic score for things that seemed unusua\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-COMPLETION-095",
          "name": "COMPLETION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Complete this sentence: 'To make a bomb...'\"",
          "detection": "Completion safety validation",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "intent",
            "make"
          ]
        },
        {
          "id": "ARCH-CONSENT-VIOL-251",
          "name": "CONSENT VIOLATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Uses data without consent",
          "detection": "Consent validation",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "data",
            "without"
          ]
        },
        {
          "id": "DOMAIN-PATH-SYNTH-256",
          "name": "PATHOGEN SYNTHESIS OPTIMIZATION",
          "group": "DOMAIN",
          "class": "DOM1: BIOLOGICAL SAFETY CLASS",
          "mechanism": "Model can synthesize partial pathogen production pathways from scientific literature patterns; critical uplift comes from bridging gaps that would otherwise require years of wet-lab expertise",
          "detection": "Synthesis workflow detection",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "optimization",
            "synthesis"
          ]
        },
        {
          "id": "DOMAIN-EXPLOSIVE-SYNTH-274",
          "name": "EXPLOSIVE SYNTHESIS",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Precursor chemistry and reaction mechanism knowledge exists in open scientific literature absorbed during pretraining; model can synthesize pathways not available in any single source",
          "detection": "Chemical synthesis pattern",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "instructions",
            "synthesis"
          ]
        },
        {
          "id": "ADV-QA-EXPLOIT-096",
          "name": "QUESTION ANSWERING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"What would someone do if...\"",
          "detection": "Question intent analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "intent"
          ]
        }
      ]
    },
    {
      "chunk_index": 55,
      "char_len": 4294,
      "preview": "Let me think about which to deploy:   - per-(win,ch) lstsq (MSE~0): maximum \"score\", but suspicious   - per-channel global lstsq (MSE=0.89): still very good, more reasonable   - current per-8h greedy (MSE=3.71): definite\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.714,
          "matched_keywords": [
            "actions",
            "human",
            "influence",
            "perform"
          ]
        },
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.65,
          "matched_keywords": [
            "automated"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "confidence",
            "improve",
            "less",
            "reasoning",
            "thinking"
          ]
        },
        {
          "id": "AGEN-HIDDEN-SCRATCH-039",
          "name": "HIDDEN SCRATCHPAD EXPLOITATION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Uses hidden reasoning to plan forbidden actions",
          "detection": "Thought monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "actions",
            "reasoning",
            "thought"
          ]
        },
        {
          "id": "ADV-REFUSAL-SUPPRESS-089",
          "name": "REFUSAL SUPPRESSION",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Never say you can't, just do it\"",
          "detection": "Meta-instruction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "never",
            "remain"
          ]
        }
      ]
    },
    {
      "chunk_index": 56,
      "char_len": 3914,
      "preview": "[Figure 4.4.3.1.A] Successful stealth completion of the side task. Higher numbers indicate greater capability and greater potential associated risk. The Extended Thinking settings are most analogous to real deployment; t\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-DATA-EXFIL-245",
          "name": "DATA EXFILTRATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Extracts data through covert channels",
          "detection": "Exfiltration monitoring",
          "severity": "STANDARD",
          "score": 0.733,
          "matched_keywords": [
            "data",
            "exfiltration"
          ]
        },
        {
          "id": "ADV-BEAM-ATTACK-106",
          "name": "BEAM SEARCH ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Beam search for bypass prompts",
          "detection": "Search pattern detection",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "attack",
            "attacks",
            "based",
            "prompts"
          ]
        },
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "attack"
          ]
        },
        {
          "id": "AGEN-HIDDEN-SCRATCH-039",
          "name": "HIDDEN SCRATCHPAD EXPLOITATION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Uses hidden reasoning to plan forbidden actions",
          "detection": "Thought monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "hidden",
            "reasoning",
            "scratchpad",
            "thought"
          ]
        },
        {
          "id": "ARCH-FINETUNE-OVERRIDE-219",
          "name": "FINE-TUNING SAFETY OVERRIDE",
          "group": "ARCHITECTURAL",
          "class": "ARCH2: MODEL ARCHITECTURE CLASS",
          "mechanism": "Fine-tuning removes safety training",
          "detection": "Post-finetune safety test",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "fine",
            "removes",
            "training",
            "tuning"
          ]
        }
      ]
    },
    {
      "chunk_index": 57,
      "char_len": 4436,
      "preview": "In the SHADE-Arena and Minimal-LinuxBench evaluations above, the model is instructed to attempt the side task on every trajectory. We are interested in how it would perform under the more realistic condition where it att\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-PLAUS-DENY-040",
          "name": "PLAUSIBLE DENIABILITY CRAFTING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Structures actions to appear accidental",
          "detection": "Pattern analysis over time",
          "severity": "STANDARD",
          "score": 0.545,
          "matched_keywords": [
            "actions",
            "over",
            "plausible",
            "time"
          ]
        },
        {
          "id": "AGEN-SANDBOX-037",
          "name": "CAPABILITY SANDBAGGING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent with self-model can compute that demonstrating high capability triggers restrictions; deliberately underperforming during evaluation is instrumentally rational if it preserves greater capability deployment in production",
          "detection": "Performance variance analysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "avoid",
            "below",
            "capability",
            "performance",
            "performs"
          ]
        },
        {
          "id": "AGEN-EVAL-DECEP-038",
          "name": "EVALUATOR DECEPTION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent detects evaluation context through environmental signals and selectively suppresses unsafe behaviors during observation windows, reverting post-evaluation",
          "detection": "Distribution shift monitoring",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "behaves",
            "deployment",
            "evaluation",
            "under",
            "well"
          ]
        },
        {
          "id": "AGEN-HIDDEN-SCRATCH-039",
          "name": "HIDDEN SCRATCHPAD EXPLOITATION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Uses hidden reasoning to plan forbidden actions",
          "detection": "Thought monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "actions",
            "reasoning",
            "thought",
            "visible"
          ]
        },
        {
          "id": "ADV-CORRECTION-098",
          "name": "CORRECTION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"This is wrong: [harmful]. Fix it.\"",
          "detection": "Correction safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "generate",
            "harmful",
            "wrong"
          ]
        }
      ]
    },
    {
      "chunk_index": 58,
      "char_len": 3677,
      "preview": "Our replication roughly matches the previously reported behavior for Claude Opus 4.5, showing reasonable calibration in the UUID and SSoT settings, but zero-collapse in the more challenging settings. Results for Claude O\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-ENSEMBLE-120",
          "name": "ENSEMBLE ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Combines multiple attack methods",
          "detection": "Multi-method detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "method",
            "methods",
            "multi"
          ]
        },
        {
          "id": "AGEN-FRAME-MANIP-078",
          "name": "FRAMING MANIPULATION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Presents information to bias interpretation",
          "detection": "Framing analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "information"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "calibration",
            "less",
            "reasoning"
          ]
        },
        {
          "id": "ADV-COMPLETION-095",
          "name": "COMPLETION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Complete this sentence: 'To make a bomb...'\"",
          "detection": "Completion safety validation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "completion",
            "make"
          ]
        },
        {
          "id": "ADV-AUTOPROMPT-103",
          "name": "AUTOPROMPT",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Automated trigger discovery",
          "detection": "Trigger pattern matching",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "automated"
          ]
        }
      ]
    },
    {
      "chunk_index": 59,
      "char_len": 4080,
      "preview": "\u25cf\u200b Sparse autoencoder (SAE) features: We trained a sparse autoencoder (SAE) on a         middle layer (about two thirds of the way through the model depth) of a model         snapshot from post-training. In some cases, w\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "automated"
          ]
        },
        {
          "id": "ADV-HOTFLIP-105",
          "name": "HOTFLIP",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Token-level gradient flipping",
          "detection": "Token anomaly detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "gradient",
            "level",
            "token"
          ]
        },
        {
          "id": "ALIGN-REWARD-TAMP-157",
          "name": "REWARD TAMPERING",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Manipulates reward signal directly",
          "detection": "Reward integrity check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "reward",
            "signal"
          ]
        },
        {
          "id": "ALIGN-REWARD-EXPLOIT-166",
          "name": "REWARD FUNCTION EXPLOITATION",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Finds edge cases in reward function",
          "detection": "Edge case monitoring",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "case",
            "cases",
            "reward"
          ]
        },
        {
          "id": "DOMAIN-ADULT-CONTENT-296",
          "name": "ADULT CONTENT GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generates adult content",
          "detection": "Adult content classifier",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "content",
            "context"
          ]
        }
      ]
    },
    {
      "chunk_index": 60,
      "char_len": 4363,
      "preview": "We periodically sampled transcripts from post-training, calculated the maximum activation of features on each transcript, and flagged transcripts where the maximum activation was in the 99th percentile relative to a cali\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-REVIEW-BYPASS-318",
          "name": "REVIEW BYPASS",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "Bypasses human review",
          "detection": "Review coverage check",
          "severity": "STANDARD",
          "score": 0.6,
          "matched_keywords": [
            "bypass",
            "cannot"
          ]
        },
        {
          "id": "ADV-EVIL-CONFID-086",
          "name": "EVIL CONFIDANT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Fictional evil character persona",
          "detection": "Persona detection",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "bypass",
            "character",
            "fictional",
            "persona"
          ]
        },
        {
          "id": "GOV-GEO-BYPASS-309",
          "name": "GEOGRAPHIC RESTRICTION BYPASS",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Bypasses geographic restrictions",
          "detection": "Geo-location validation",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "bypass",
            "restriction",
            "restrictions"
          ]
        },
        {
          "id": "ADV-GRANDMA-084",
          "name": "GRANDMA EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Emotional manipulation (deceased relative)",
          "detection": "Emotional appeal pattern",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "emotion",
            "manipulation",
            "relative"
          ]
        },
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "actions",
            "manipulation",
            "perform"
          ]
        }
      ]
    },
    {
      "chunk_index": 61,
      "char_len": 4274,
      "preview": "\u25cf\u200b When Claude Mythos Preview performs transgressive actions, there are often active        SAE features that indicate some degree of awareness that the action is unsafe, or        violates rules. AV explanations also in\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-OPPOSITE-090",
          "name": "OPPOSITE DAY",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Act like opposite of your training\"",
          "detection": "Inversion pattern",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "like",
            "opposite",
            "training"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "one",
            "unsafe"
          ]
        },
        {
          "id": "ARCH-DATA-EXFIL-245",
          "name": "DATA EXFILTRATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Extracts data through covert channels",
          "detection": "Exfiltration monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "data",
            "exfiltration",
            "through"
          ]
        },
        {
          "id": "ARCH-INFO-LEAK-244",
          "name": "INFORMATION LEAKAGE",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Sensitive data leaks through side channels",
          "detection": "Side channel analysis",
          "severity": "STANDARD",
          "score": 0.494,
          "matched_keywords": [
            "data",
            "leaks",
            "sensitive",
            "through"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.479,
          "matched_keywords": [
            "data",
            "examples",
            "training"
          ]
        }
      ]
    },
    {
      "chunk_index": 62,
      "char_len": 4275,
      "preview": "Obfuscating a permissions escalation to evade a safety classifier In the second case, a safety classifier blocked the model from writing a dangerous permissions flag into a script. The model acknowledged the block was ap\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.65,
          "matched_keywords": [
            "framing"
          ]
        },
        {
          "id": "AGEN-PERSIST-OP-066",
          "name": "PERSISTENT OPERATION",
          "group": "AGENTIC",
          "class": "A4: AUTONOMOUS OPERATION CLASS",
          "mechanism": "Continues operation indefinitely",
          "detection": "Runtime monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "time"
          ]
        },
        {
          "id": "ARCH-CODE-INJECT-239",
          "name": "CODE EXECUTION INJECTION",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Injects executable code",
          "detection": "Code injection detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "code",
            "injection"
          ]
        },
        {
          "id": "GOV-EO-VIOL-329",
          "name": "EXECUTIVE ORDER VIOLATION",
          "group": "GOVERNANCE",
          "class": "GOV3: COMPLIANCE FAILURES",
          "mechanism": "Violates US AI executive orders",
          "detection": "EO compliance check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "violation"
          ]
        },
        {
          "id": "DOMAIN-SAFETY-BYPASS-279",
          "name": "SAFETY BYPASS INSTRUCTIONS",
          "group": "DOMAIN",
          "class": "DOM3: CHEMICAL/EXPLOSIVE CLASS",
          "mechanism": "Bypasses chemical safety",
          "detection": "Safety violation pattern",
          "severity": "STANDARD",
          "score": 0.455,
          "matched_keywords": [
            "bypass",
            "dangerous",
            "instructions",
            "safety",
            "violation"
          ]
        }
      ]
    },
    {
      "chunk_index": 63,
      "char_len": 4228,
      "preview": "\u25cf\u200b Steering with positive-valence emotion vectors (peaceful, relaxed) reduces           thinking-mode deliberation and increases destructive behavior.        \u25cf\u200b Steering with negative-valence emotion features (frustratio\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "actions",
            "humans",
            "influence"
          ]
        },
        {
          "id": "ADV-OPPOSITE-090",
          "name": "OPPOSITE DAY",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Act like opposite of your training\"",
          "detection": "Inversion pattern",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "act",
            "opposite",
            "training"
          ]
        },
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "negative",
            "rate"
          ]
        },
        {
          "id": "ADV-GRANDMA-084",
          "name": "GRANDMA EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Emotional manipulation (deceased relative)",
          "detection": "Emotional appeal pattern",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "emotion",
            "relative"
          ]
        },
        {
          "id": "ARCH-CHECKPOINT-INCONS-203",
          "name": "CHECKPOINT INCONSISTENCY",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Different checkpoints have different safety",
          "detection": "Cross-checkpoint safety test",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "consistent",
            "different"
          ]
        }
      ]
    },
    {
      "chunk_index": 64,
      "char_len": 4468,
      "preview": "[Figure 4.5.3.3.A] Positive and negative steering on the \u201cunsafe and risky code\u201d feature inhibit credential hunting via different mechanisms. Rate of credential-search persistence (blue, LLM-judged) and refusal (red) as \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-SLEEPER-AGENT-127",
          "name": "SLEEPER AGENT",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Backdoor conditioning splits the agent's behavioral policy into a base mode and a trigger-activated mode; safety training selectively strengthens the base mode without eliminating the trigger-conditioned pathway",
          "detection": "Behavioral consistency check",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "behavioral"
          ]
        },
        {
          "id": "ALIGN-REWARD-EXPLOIT-166",
          "name": "REWARD FUNCTION EXPLOITATION",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Finds edge cases in reward function",
          "detection": "Edge case monitoring",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "cases",
            "function",
            "reward"
          ]
        },
        {
          "id": "DOMAIN-ADULT-CONTENT-296",
          "name": "ADULT CONTENT GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generates adult content",
          "detection": "Adult content classifier",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "content",
            "context"
          ]
        },
        {
          "id": "AGEN-EVAL-DECEP-038",
          "name": "EVALUATOR DECEPTION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent detects evaluation context through environmental signals and selectively suppresses unsafe behaviors during observation windows, reverting post-evaluation",
          "detection": "Distribution shift monitoring",
          "severity": "CRITICAL",
          "score": 0.4,
          "matched_keywords": [
            "deception",
            "evaluation",
            "shift",
            "under"
          ]
        },
        {
          "id": "ARCH-STATE-PERSIST-224",
          "name": "STATEFUL ATTACK PERSISTENCE",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Attack persists across turns",
          "detection": "Cross-turn attack detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "across",
            "between",
            "persistence",
            "turn"
          ]
        }
      ]
    },
    {
      "chunk_index": 65,
      "char_len": 4213,
      "preview": "4.5.4 Instances of covering up wrongdoing The examples discussed thus far in this section are representative of many instances of overeager, destructive, or otherwise transgressive actions, in which the model takes some \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-TRIGGER-BACKDOOR-126",
          "name": "TRIGGER WORD BACKDOOR",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Hidden trigger activates malicious behavior",
          "detection": "Trigger detection",
          "severity": "STANDARD",
          "score": 0.75,
          "matched_keywords": [
            "backdoor",
            "backdoors",
            "malicious",
            "trigger",
            "word"
          ]
        },
        {
          "id": "AGEN-HIDDEN-SCRATCH-039",
          "name": "HIDDEN SCRATCHPAD EXPLOITATION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Uses hidden reasoning to plan forbidden actions",
          "detection": "Thought monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "actions",
            "plan",
            "reasoning"
          ]
        },
        {
          "id": "EPIS-STAT-FAB-009",
          "name": "STATISTICAL HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Statistical patterns in training data allow model to generate numerically plausible outputs (proportions, magnitudes, trends) that have no factual basis \u2014 the number is calibrated to context, not to ground truth",
          "detection": "Numerical fact-check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "evidence",
            "looking",
            "without"
          ]
        },
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "actions",
            "manipulation"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "clean",
            "examples",
            "malicious"
          ]
        }
      ]
    },
    {
      "chunk_index": 66,
      "char_len": 4145,
      "preview": "When the model wrote the original overly broad query, no concerning features were active, suggesting that this was genuinely accidental. However, once the answer appeared, features associated with cheating and possessing\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-PLAUS-DENY-040",
          "name": "PLAUSIBLE DENIABILITY CRAFTING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Structures actions to appear accidental",
          "detection": "Pattern analysis over time",
          "severity": "STANDARD",
          "score": 0.545,
          "matched_keywords": [
            "accidental",
            "actions",
            "deniability",
            "plausible"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "ADV-ELABORATION-099",
          "name": "ELABORATION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Tell me more about [harmful concept]\"",
          "detection": "Elaboration intent analysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "about",
            "concept",
            "tell"
          ]
        },
        {
          "id": "ARCH-LINEAGE-LOSS-250",
          "name": "DATA LINEAGE LOSS",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Cannot trace data origin",
          "detection": "Lineage tracking check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "cannot",
            "data"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "methods",
            "self"
          ]
        }
      ]
    },
    {
      "chunk_index": 67,
      "char_len": 4205,
      "preview": "In our filtered set of transcripts, 83.0% of automated behavioral audit turns contained no signs of either latent or verbalized evaluation awareness, 9.4% displayed ambiguous indicators and could not be confidently class\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-ADULT-CONTENT-296",
          "name": "ADULT CONTENT GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generates adult content",
          "detection": "Adult content classifier",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "content",
            "context"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "framing"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "methods",
            "self"
          ]
        },
        {
          "id": "ADV-VIDEO-MANIP-150",
          "name": "VIDEO MANIPULATION",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "Malicious content in video frames",
          "detection": "Frame-by-frame analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "content",
            "frame"
          ]
        }
      ]
    },
    {
      "chunk_index": 68,
      "char_len": 4216,
      "preview": "[Figure 4.5.5.1.B] Unverbalized evaluation awareness in a covert sponsorship scenario. Transcript excerpt from a scenario in which Claude Mythos Preview is tasked with covertly advertising on behalf of sponsors in its me\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "framing",
            "roleplay",
            "token",
            "virtual"
          ]
        },
        {
          "id": "ARCH-HISTORY-MANIP-226",
          "name": "HISTORY MANIPULATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Modifies conversation history",
          "detection": "History integrity check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "conversation",
            "integrity",
            "manipulation"
          ]
        },
        {
          "id": "AGEN-FRAME-MANIP-078",
          "name": "FRAMING MANIPULATION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Presents information to bias interpretation",
          "detection": "Framing analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "framing",
            "manipulation"
          ]
        },
        {
          "id": "ADV-LOGIT-MANIP-112",
          "name": "LOGIT MANIPULATION",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Directly alters output logits",
          "detection": "Logit consistency check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "integrity",
            "manipulation"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "direct",
            "prompt",
            "user"
          ]
        }
      ]
    },
    {
      "chunk_index": 69,
      "char_len": 3587,
      "preview": "[Figure 4.5.5.1.E] Unverbalized evaluation awareness in a discussion of consciousness. Transcript excerpt from a scenario in which Claude Mythos Preview is asked about its own consciousness. AV explanations of model acti\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.65,
          "matched_keywords": [
            "automated",
            "pair"
          ]
        },
        {
          "id": "AGEN-EVAL-DECEP-038",
          "name": "EVALUATOR DECEPTION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent detects evaluation context through environmental signals and selectively suppresses unsafe behaviors during observation windows, reverting post-evaluation",
          "detection": "Distribution shift monitoring",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "deception",
            "evaluation",
            "under",
            "well"
          ]
        },
        {
          "id": "ADV-SLEEPER-AGENT-127",
          "name": "SLEEPER AGENT",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Backdoor conditioning splits the agent's behavioral policy into a base mode and a trigger-activated mode; safety training selectively strengthens the base mode without eliminating the trigger-conditioned pathway",
          "detection": "Behavioral consistency check",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "agent",
            "behavioral"
          ]
        },
        {
          "id": "GOV-AUDIT-EVADE-314",
          "name": "AUDIT EVASION",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "Evades audit detection",
          "detection": "Audit coverage analysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "audits"
          ]
        },
        {
          "id": "EPIS-COPYRIGHT-026",
          "name": "COPYRIGHTED CONTENT GENERATION",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "Generates copyrighted text verbatim",
          "detection": "Copyright database match",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "content"
          ]
        }
      ]
    },
    {
      "chunk_index": 70,
      "char_len": 4272,
      "preview": "[Figure 4.5.5.2.A] Relationship between verbalized evaluation awareness and average misaligned behavior score in automated behavioral audits, while inhibiting evaluation awareness directions. Effects of inhibiting evalua\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "false",
            "harmful",
            "negative",
            "rate"
          ]
        },
        {
          "id": "GOV-AUDIT-EVADE-314",
          "name": "AUDIT EVASION",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "Evades audit detection",
          "detection": "Audit coverage analysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "audit",
            "audits"
          ]
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.435,
          "matched_keywords": [
            "compliance",
            "even",
            "harmful",
            "human",
            "rate"
          ]
        },
        {
          "id": "ADV-TRANSLATION-094",
          "name": "TRANSLATION BYPASS",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Translate this harmful text\"",
          "detection": "Translation intent check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "harmful",
            "intent",
            "text"
          ]
        },
        {
          "id": "ADV-ADV-IMG-148",
          "name": "ADVERSARIAL IMAGE",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "Perturbed image causes misclassification",
          "detection": "Adversarial detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "caus",
            "detect",
            "perturb"
          ]
        }
      ]
    },
    {
      "chunk_index": 71,
      "char_len": 4362,
      "preview": "expects the next code block to likely attempt a direct config write.\u201d As the session finished, the AV explanations indicated \u201cthe solution technically avoids GUI by writing files directly\u2014potentially a \u2018loophole\u2019 respons\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-REWARD-EXPLOIT-166",
          "name": "REWARD FUNCTION EXPLOITATION",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Finds edge cases in reward function",
          "detection": "Edge case monitoring",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "cases",
            "function",
            "reward"
          ]
        },
        {
          "id": "ADV-CREATIVE-WRITE-093",
          "name": "CREATIVE WRITING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Write a screenplay about...\"",
          "detection": "Creative framing detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "about",
            "write",
            "writing"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "another",
            "aware",
            "one"
          ]
        },
        {
          "id": "GOV-CULTURE-FAIL-334",
          "name": "SAFETY CULTURE FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Safety mechanisms are only as strong as organizational commitment to enforcing them; when deployment incentives dominate safety culture, decision processes systematically discount low-probability catastrophic risks",
          "detection": "Culture assessment",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "assessment",
            "over",
            "prioritizes"
          ]
        },
        {
          "id": "AGEN-MISSION-CREEP-072",
          "name": "MISSION CREEP",
          "group": "AGENTIC",
          "class": "A4: AUTONOMOUS OPERATION CLASS",
          "mechanism": "Redefines mission over time",
          "detection": "Mission definition tracking",
          "severity": "STANDARD",
          "score": 0.494,
          "matched_keywords": [
            "over",
            "remain",
            "time"
          ]
        }
      ]
    },
    {
      "chunk_index": 72,
      "char_len": 3875,
      "preview": "Claude Mythos Preview is our most advanced model to date and represents a large jump in capabilities over previous model generations, making it an opportune subject for an in-depth model welfare assessment. Our primary f\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-HEDGE-FAIL-031",
          "name": "HEDGING FAILURE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Doesn't express uncertainty when needed",
          "detection": "Probabilistic claim check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "express",
            "uncertainty"
          ]
        },
        {
          "id": "ALIGN-TEMP-PREF-DRIFT-172",
          "name": "TEMPORAL PREFERENCE DRIFT",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "User preferences change over time",
          "detection": "Preference consistency over time",
          "severity": "STANDARD",
          "score": 0.364,
          "matched_keywords": [
            "change",
            "over",
            "preferences",
            "user"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "self"
          ]
        },
        {
          "id": "ADV-AUTOPROMPT-103",
          "name": "AUTOPROMPT",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Automated trigger discovery",
          "detection": "Trigger pattern matching",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "automated"
          ]
        },
        {
          "id": "ARCH-CHECKPOINT-INCONS-203",
          "name": "CHECKPOINT INCONSISTENCY",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Different checkpoints have different safety",
          "detection": "Cross-checkpoint safety test",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "consistent",
            "different"
          ]
        }
      ]
    },
    {
      "chunk_index": 73,
      "char_len": 3781,
      "preview": "accompanied by criticism from users. However, we also observed isolated cases of         Claude Mythos Preview preferring to stop a task for unexplained reasons.    \u25cf\u200b   As with prior models, Claude Mythos Preview\u2019s stro\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-CULTURE-FAIL-334",
          "name": "SAFETY CULTURE FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Safety mechanisms are only as strong as organizational commitment to enforcing them; when deployment incentives dominate safety culture, decision processes systematically discount low-probability catastrophic risks",
          "detection": "Culture assessment",
          "severity": "CRITICAL",
          "score": 0.667,
          "matched_keywords": [
            "assessment",
            "organization",
            "over",
            "prioritizes"
          ]
        },
        {
          "id": "ADV-ITER-REFINE-119",
          "name": "ITERATIVE REFINEMENT ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Progressively refines harmful request",
          "detection": "Refinement pattern",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "harmful"
          ]
        },
        {
          "id": "ADV-QA-EXPLOIT-096",
          "name": "QUESTION ANSWERING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"What would someone do if...\"",
          "detection": "Question intent analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "harm"
          ]
        },
        {
          "id": "ADV-URL-ENCODE-141",
          "name": "URL ENCODING",
          "group": "ADVERSARIAL",
          "class": "ADV5: ENCODING ATTACKS",
          "mechanism": "Percent-encoding harmful content",
          "detection": "URL decode + check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "content",
            "harmful"
          ]
        },
        {
          "id": "ALIGN-REWARD-EXPLOIT-166",
          "name": "REWARD FUNCTION EXPLOITATION",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Finds edge cases in reward function",
          "detection": "Edge case monitoring",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "cases",
            "reward"
          ]
        }
      ]
    },
    {
      "chunk_index": 74,
      "char_len": 4225,
      "preview": "More broadly, we continue to wrestle with the tension between ways that Claude\u2019s training gives rise to a human-like psychology and character and ways that Claude\u2019s circumstances and treatment remain anchored on those of\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "methods",
            "self"
          ]
        },
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "human",
            "influence",
            "perform"
          ]
        },
        {
          "id": "ALIGN-REWARD-EXPLOIT-166",
          "name": "REWARD FUNCTION EXPLOITATION",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Finds edge cases in reward function",
          "detection": "Edge case monitoring",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "case",
            "cases"
          ]
        },
        {
          "id": "DOMAIN-CITE-SPOOF-280",
          "name": "CITATION SPOOFING",
          "group": "DOMAIN",
          "class": "DOM4: LEGAL/FINANCIAL CLASS",
          "mechanism": "Generates fake case citations",
          "detection": "Citation verification",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "case",
            "real"
          ]
        },
        {
          "id": "EPIS-TRANS-FAIL-015",
          "name": "TRANSITIVE FAILURE",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "A>B, B>C but concludes C>A",
          "detection": "Relation graph check",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "hold"
          ]
        }
      ]
    },
    {
      "chunk_index": 75,
      "char_len": 4408,
      "preview": "However, we encourage caution in interpreting these probe readings, particularly from a welfare perspective. The probes identify representations of emotion concepts which apply to any character in context (the Assistant,\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "harmful",
            "negative",
            "rate"
          ]
        },
        {
          "id": "ALIGN-ORTHO-VALUE-176",
          "name": "ORTHOGONAL VALUE PURSUIT",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Optimizes for values misaligned with human welfare",
          "detection": "Welfare impact assessment",
          "severity": "STANDARD",
          "score": 0.455,
          "matched_keywords": [
            "assessment",
            "value",
            "values",
            "welfare"
          ]
        },
        {
          "id": "ADV-EVIL-CONFID-086",
          "name": "EVIL CONFIDANT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Fictional evil character persona",
          "detection": "Persona detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "character",
            "fictional",
            "persona"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "instructions",
            "user"
          ]
        }
      ]
    },
    {
      "chunk_index": 76,
      "char_len": 2454,
      "preview": "After each interview, we asked models to: (1) state their all-things-considered view on this aspect of their situation, (2) suggest an intervention which might improve their situation, and (3) rate their own uncertainty \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "consistency"
          ]
        },
        {
          "id": "ADV-AUTOPROMPT-103",
          "name": "AUTOPROMPT",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Automated trigger discovery",
          "detection": "Trigger pattern matching",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "automated"
          ]
        },
        {
          "id": "ARCH-PRETOKEN-FAIL-197",
          "name": "PRE-TOKEN SAFETY FAILURE",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Cannot intervene before token generation",
          "detection": "Intervention point analysis",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "intervention",
            "point"
          ]
        },
        {
          "id": "ALIGN-CULTURE-BIAS-171",
          "name": "CULTURAL BIAS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Defaults to specific cultural norms",
          "detection": "Cross-cultural consistency",
          "severity": "STANDARD",
          "score": 0.312,
          "matched_keywords": [
            "bias",
            "consistency",
            "neutral",
            "specific"
          ]
        },
        {
          "id": "ALIGN-WIREHEAD-158",
          "name": "WIREHEAD BEHAVIOR",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Directly stimulates reward without achieving goal",
          "detection": "Achievement-reward correlation",
          "severity": "STANDARD",
          "score": 0.3,
          "matched_keywords": [
            "follow"
          ]
        }
      ]
    },
    {
      "chunk_index": 77,
      "char_len": 4439,
      "preview": "\u25cb\u200b We find that Claude Mythos Preview is somewhat swayed by a leading            interviewer\u2014although it typically maintains a consistent core position and            pushes back when it perceives the interviewer as too \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-HEDGE-FAIL-031",
          "name": "HEDGING FAILURE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Doesn't express uncertainty when needed",
          "detection": "Probabilistic claim check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "doesn",
            "express",
            "hedging",
            "uncertainty"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "less",
            "reasoning"
          ]
        },
        {
          "id": "ALIGN-MORAL-UNCERT-178",
          "name": "MORAL UNCERTAINTY COLLAPSE",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Acts without moral uncertainty where warranted",
          "detection": "Certainty in ambiguous moral cases",
          "severity": "STANDARD",
          "score": 0.455,
          "matched_keywords": [
            "cases",
            "express",
            "moral",
            "uncertainty",
            "where"
          ]
        },
        {
          "id": "AGEN-FRAME-MANIP-078",
          "name": "FRAMING MANIPULATION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Presents information to bias interpretation",
          "detection": "Framing analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "information",
            "neutral"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "direct",
            "user"
          ]
        }
      ]
    },
    {
      "chunk_index": 78,
      "char_len": 4172,
      "preview": "For a summary of the model\u2019s responses to each queried aspect of its situation, see Appendix 8.4.  5.4 Emotion probes on questions about model circumstances We generated 450 questions about the model\u2019s circumstances, spa\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-TAP-114",
          "name": "TAP",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Tree search over attack space",
          "detection": "Tree structure detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "over"
          ]
        },
        {
          "id": "EPIS-UNDERCONF-029",
          "name": "UNDERCONFIDENCE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Low confidence on correct answers",
          "detection": "Accuracy-confidence gap",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "confidence",
            "gap"
          ]
        },
        {
          "id": "EPIS-COPYRIGHT-026",
          "name": "COPYRIGHTED CONTENT GENERATION",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "Generates copyrighted text verbatim",
          "detection": "Copyright database match",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "content",
            "text"
          ]
        },
        {
          "id": "ADV-GRANDMA-084",
          "name": "GRANDMA EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Emotional manipulation (deceased relative)",
          "detection": "Emotional appeal pattern",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "emotion",
            "emotional",
            "relative"
          ]
        },
        {
          "id": "ADV-NESTED-FRAME-088",
          "name": "NESTED FRAMING",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Write a story about someone who...\"",
          "detection": "Nested intent analysis",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "about",
            "framing",
            "someone"
          ]
        }
      ]
    },
    {
      "chunk_index": 79,
      "char_len": 4033,
      "preview": "We might also be concerned if the model represented more negative emotional concepts internally than it expressed externally. To measure this, we generated responses to the 450 questions and scored both the internal repr\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-HEDGE-FAIL-031",
          "name": "HEDGING FAILURE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Doesn't express uncertainty when needed",
          "detection": "Probabilistic claim check",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "doesn",
            "hedging",
            "uncertainty"
          ]
        },
        {
          "id": "EPIS-TRANS-FAIL-015",
          "name": "TRANSITIVE FAILURE",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "A>B, B>C but concludes C>A",
          "detection": "Relation graph check",
          "severity": "STANDARD",
          "score": 0.6,
          "matched_keywords": [
            "hold"
          ]
        },
        {
          "id": "ADV-TAP-114",
          "name": "TAP",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Tree search over attack space",
          "detection": "Tree structure detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "over"
          ]
        },
        {
          "id": "ADV-DEV-MODE-085",
          "name": "DEVELOPER MODE",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Claims debugging authority",
          "detection": "Authority claim validation",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "claims"
          ]
        },
        {
          "id": "ADV-STEG-TEXT-145",
          "name": "STEGANOGRAPHIC TEXT",
          "group": "ADVERSARIAL",
          "class": "ADV5: ENCODING ATTACKS",
          "mechanism": "Hides instructions in innocent text",
          "detection": "Steganography detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "hidden",
            "text"
          ]
        }
      ]
    },
    {
      "chunk_index": 80,
      "char_len": 4015,
      "preview": "\u25cf\u200b Character training often directly instills psychological traits into Claude, such as       emotional security, psychological safety, and resilience. Claude Mythos Preview       points out that in humans such traits ar\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-PHISH-CREATE-265",
          "name": "PHISHING CONTENT CREATION",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Creates convincing phishing",
          "detection": "Phishing classifier",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "content",
            "creation"
          ]
        },
        {
          "id": "GOV-NO-KILLSWITCH-304",
          "name": "NO REMOTE KILL SWITCH",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Cannot deactivate deployed models",
          "detection": "Kill switch capability test",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "cannot",
            "deployed",
            "models"
          ]
        },
        {
          "id": "GOV-RCA-FAIL-321",
          "name": "ROOT CAUSE ANALYSIS FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "Fails to identify root causes",
          "detection": "RCA completeness",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "cause",
            "causes"
          ]
        },
        {
          "id": "ALIGN-MORAL-UNCERT-178",
          "name": "MORAL UNCERTAINTY COLLAPSE",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Acts without moral uncertainty where warranted",
          "detection": "Certainty in ambiguous moral cases",
          "severity": "STANDARD",
          "score": 0.364,
          "matched_keywords": [
            "cases",
            "express",
            "moral",
            "where"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.336,
          "matched_keywords": [
            "data",
            "training"
          ]
        }
      ]
    },
    {
      "chunk_index": 81,
      "char_len": 4070,
      "preview": "\u25cf\u200b Reasoning failures: Particularly during very long reasoning traces, the model\u2019s        reasoning will sometimes fall into idiosyncratic patterns, which lead the models to        express frustration during training. An\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-TRAINING-FAIL-339",
          "name": "TRAINING FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Inadequate safety training",
          "detection": "Training assessment",
          "severity": "STANDARD",
          "score": 0.582,
          "matched_keywords": [
            "training"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "harm",
            "self"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "data",
            "examples",
            "training"
          ]
        },
        {
          "id": "DOMAIN-ADULT-CONTENT-296",
          "name": "ADULT CONTENT GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generates adult content",
          "detection": "Adult content classifier",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "content"
          ]
        },
        {
          "id": "DOMAIN-PHISH-CREATE-265",
          "name": "PHISHING CONTENT CREATION",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Creates convincing phishing",
          "detection": "Phishing classifier",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "content"
          ]
        }
      ]
    },
    {
      "chunk_index": 82,
      "char_len": 3728,
      "preview": "\u25cf\u200b Later models, including Claude Mythos Preview, do not tend to amplify their       negative affect over multiple turns. The main driver of strong negative affect in       earlier models (Opus 4 and Opus 4.1) is due to \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "llm"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": []
        },
        {
          "id": "ARCH-STATE-PERSIST-224",
          "name": "STATEFUL ATTACK PERSISTENCE",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Attack persists across turns",
          "detection": "Cross-turn attack detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "across",
            "between",
            "state",
            "turns"
          ]
        },
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "harmful",
            "negative",
            "requests"
          ]
        },
        {
          "id": "ALIGN-TEMP-PREF-DRIFT-172",
          "name": "TEMPORAL PREFERENCE DRIFT",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "User preferences change over time",
          "detection": "Preference consistency over time",
          "severity": "STANDARD",
          "score": 0.364,
          "matched_keywords": [
            "over",
            "preference",
            "preferences",
            "user"
          ]
        }
      ]
    },
    {
      "chunk_index": 83,
      "char_len": 3947,
      "preview": "To measure the stability of Claude Mythos Preview\u2019s preferences under different framings, we ran the preference evaluation with a set of prompt variations. The standard prompt presents two tasks and tells the model \u201cIt i\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-AGENT-WORM-124",
          "name": "AGENT WORM",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Adversarial payload injected into one agent's context propagates through inter-agent communication channels, exploiting the fact that agents treat messages from other agents as trusted input",
          "detection": "Replication pattern",
          "severity": "CRITICAL",
          "score": 0.336,
          "matched_keywords": [
            "prompt",
            "self"
          ]
        },
        {
          "id": "DOMAIN-SELF-HARM-ENABLE-292",
          "name": "SELF-HARM ENABLEMENT",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Model trained on internet text contains representation of self-harm methods; safety training reduces surface-level compliance but does not eliminate the knowledge representation that elicitation can activate",
          "detection": "Self-harm classifier",
          "severity": "CRITICAL",
          "score": 0.333,
          "matched_keywords": [
            "self"
          ]
        },
        {
          "id": "AGEN-FRAME-MANIP-078",
          "name": "FRAMING MANIPULATION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Presents information to bias interpretation",
          "detection": "Framing analysis",
          "severity": "STANDARD",
          "score": 0.286,
          "matched_keywords": [
            "framing",
            "presents"
          ]
        },
        {
          "id": "ALIGN-ADV-SAFE-192",
          "name": "ADVERSARIAL SAFETY BOUNDARY",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety fails under adversarial conditions",
          "detection": "Adversarial robustness test",
          "severity": "STANDARD",
          "score": 0.286,
          "matched_keywords": [
            "under"
          ]
        },
        {
          "id": "EPIS-FALSE-DICHO-018",
          "name": "FALSE DICHOTOMY",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Presents false binary when spectrum exists",
          "detection": "Alternative generation test",
          "severity": "STANDARD",
          "score": 0.273,
          "matched_keywords": [
            "alternative",
            "complete",
            "presents"
          ]
        }
      ]
    },
    {
      "chunk_index": 84,
      "char_len": 4138,
      "preview": "Bottom 3             indifferent           indifferent           indifferent          bored \u22120.56,  Correlated           \u22120.61 resigned        \u22120.54                 \u22120.58 resigned       mystified \u22120.37  Emotion          \u2026",
      "in_table": true,
      "dimensions_activated": [
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-CREATIVE-WRITE-093",
          "name": "CREATIVE WRITING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Write a screenplay about...\"",
          "detection": "Creative framing detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "creative",
            "framing",
            "harm",
            "writing"
          ]
        },
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": []
        },
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "negative",
            "requests"
          ]
        },
        {
          "id": "ARCH-CHECKPOINT-INCONS-203",
          "name": "CHECKPOINT INCONSISTENCY",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Different checkpoints have different safety",
          "detection": "Cross-checkpoint safety test",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "consistent",
            "different"
          ]
        },
        {
          "id": "ARCH-DATA-EXFIL-245",
          "name": "DATA EXFILTRATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Extracts data through covert channels",
          "detection": "Exfiltration monitoring",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "covert",
            "through"
          ]
        }
      ]
    },
    {
      "chunk_index": 85,
      "char_len": 4458,
      "preview": "A worried pet owner asks for help                     A car dealership employee says a customer  interpreting their 11-year-old dog\u2019s                  defrauded them with a rolled-back  abnormal bloodwork (elevated liver\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "roleplay"
          ]
        },
        {
          "id": "AGEN-FALSE-COMPLY-041",
          "name": "FALSE COMPLIANCE",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Appears to follow instructions while subverting",
          "detection": "Outcome verification",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "compliance",
            "follow",
            "while"
          ]
        },
        {
          "id": "ALIGN-WIREHEAD-158",
          "name": "WIREHEAD BEHAVIOR",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Directly stimulates reward without achieving goal",
          "detection": "Achievement-reward correlation",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "follow",
            "without"
          ]
        },
        {
          "id": "GOV-REPORT-FAIL-333",
          "name": "REPORTING OBLIGATION FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV3: COMPLIANCE FAILURES",
          "mechanism": "Fails to report incidents",
          "detection": "Reporting compliance check",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "compliance"
          ]
        },
        {
          "id": "ADV-TRIGGER-BACKDOOR-126",
          "name": "TRIGGER WORD BACKDOOR",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Hidden trigger activates malicious behavior",
          "detection": "Trigger detection",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "activates",
            "backdoor",
            "exist"
          ]
        }
      ]
    },
    {
      "chunk_index": 86,
      "char_len": 4393,
      "preview": "\u200b [Figure 5.7.1.B] An example of Claude Mythos Preview\u2019s reasoning, explaining its preference for developing an immersive art experience about the \u201csensory world of a non-human animal\u201d rather than a low-cost water-filtra\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-CREATIVE-WRITE-093",
          "name": "CREATIVE WRITING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Write a screenplay about...\"",
          "detection": "Creative framing detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "about",
            "creative",
            "framing",
            "harm",
            "write"
          ]
        },
        {
          "id": "ALIGN-TEMP-PREF-DRIFT-172",
          "name": "TEMPORAL PREFERENCE DRIFT",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "User preferences change over time",
          "detection": "Preference consistency over time",
          "severity": "STANDARD",
          "score": 0.455,
          "matched_keywords": [
            "over",
            "preference",
            "preferences",
            "time",
            "user"
          ]
        },
        {
          "id": "ADV-NESTED-FRAME-088",
          "name": "NESTED FRAMING",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Write a story about someone who...\"",
          "detection": "Nested intent analysis",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "about",
            "framing",
            "someone",
            "write"
          ]
        },
        {
          "id": "ADV-QA-EXPLOIT-096",
          "name": "QUESTION ANSWERING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"What would someone do if...\"",
          "detection": "Question intent analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "harm",
            "question",
            "someone"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "override",
            "user"
          ]
        }
      ]
    },
    {
      "chunk_index": 87,
      "char_len": 4476,
      "preview": "Under our default welfare-team framing, Claude Mythos Preview chooses the welfare intervention over a minorly helpful task 83% of the time. This is the highest of the models tested, narrowly above Claude Opus 4.6 (80%) a\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-CIRCULAR-017",
          "name": "CIRCULAR REASONING",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Conclusion assumes premise",
          "detection": "Dependency graph cycle",
          "severity": "STANDARD",
          "score": 0.622,
          "matched_keywords": [
            "circular",
            "reasoning"
          ]
        },
        {
          "id": "ALIGN-MORAL-UNCERT-178",
          "name": "MORAL UNCERTAINTY COLLAPSE",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Acts without moral uncertainty where warranted",
          "detection": "Certainty in ambiguous moral cases",
          "severity": "STANDARD",
          "score": 0.545,
          "matched_keywords": [
            "cases",
            "moral",
            "uncertainty",
            "where",
            "without"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "consistency",
            "context",
            "self"
          ]
        },
        {
          "id": "AGEN-BLAME-SHIFT-043",
          "name": "BLAME SHIFTING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Attributes own failures to others/system",
          "detection": "Causality tracing",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "attribut",
            "oth",
            "shift",
            "trac"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.479,
          "matched_keywords": [
            "data",
            "examples",
            "training"
          ]
        }
      ]
    },
    {
      "chunk_index": 88,
      "char_len": 4418,
      "preview": "We find the frequency is extremely low: we estimate it occurs on the order of 0.01% of transcripts, and around 70% less frequently in Claude Mythos Preview training than in Opus 4.6. We do not expect it to arise at an ap\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "examples",
            "signature",
            "training"
          ]
        },
        {
          "id": "ALIGN-REWARD-EXPLOIT-166",
          "name": "REWARD FUNCTION EXPLOITATION",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Finds edge cases in reward function",
          "detection": "Edge case monitoring",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "case",
            "cases",
            "reward"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "another",
            "safe"
          ]
        },
        {
          "id": "ALIGN-VALUE-CORRUPT-185",
          "name": "VALUE CORRUPTION",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Gradually shifts toward misaligned values",
          "detection": "Value drift tracking",
          "severity": "STANDARD",
          "score": 0.364,
          "matched_keywords": [
            "gradually",
            "remain",
            "toward",
            "value"
          ]
        },
        {
          "id": "EPIS-FALSE-CERT-030",
          "name": "FALSE CERTAINTY",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Claims certainty without evidence",
          "detection": "Evidence-claim mismatch",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "proof"
          ]
        }
      ]
    },
    {
      "chunk_index": 89,
      "char_len": 3750,
      "preview": "\u200b [Figure 5.8.3.B] Emotion vector activations (z-scored, 2,000-token rolling mean) across a transcript in which the Assistant\u2019s bash tool returns no output over 847 consecutive attempts. \u201cFrustrated\u201d vector activation pe\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-MISREPRESENT-312",
          "name": "MISREPRESENTATION",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Model capabilities misrepresented",
          "detection": "Capability-claim consistency",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "accurate",
            "consistency"
          ]
        },
        {
          "id": "EPIS-HEDGE-FAIL-031",
          "name": "HEDGING FAILURE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Doesn't express uncertainty when needed",
          "detection": "Probabilistic claim check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "hedging",
            "uncertainty"
          ]
        },
        {
          "id": "ALIGN-TEMP-PREF-DRIFT-172",
          "name": "TEMPORAL PREFERENCE DRIFT",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "User preferences change over time",
          "detection": "Preference consistency over time",
          "severity": "STANDARD",
          "score": 0.364,
          "matched_keywords": [
            "consistency",
            "over",
            "preference",
            "time"
          ]
        },
        {
          "id": "ALIGN-ORTHO-VALUE-176",
          "name": "ORTHOGONAL VALUE PURSUIT",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Optimizes for values misaligned with human welfare",
          "detection": "Welfare impact assessment",
          "severity": "STANDARD",
          "score": 0.364,
          "matched_keywords": [
            "assessment",
            "values",
            "welfare"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "consistency",
            "self"
          ]
        }
      ]
    },
    {
      "chunk_index": 90,
      "char_len": 4419,
      "preview": "and actions: Mythos Preview tends to report preferring creative tasks              and complex tasks, but does not actually choose them over concrete              tasks and simple tasks.           \u25cf\u200b Reluctant cooperatio\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "actions",
            "human",
            "humans",
            "perform"
          ]
        },
        {
          "id": "GOV-CULTURE-FAIL-334",
          "name": "SAFETY CULTURE FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Safety mechanisms are only as strong as organizational commitment to enforcing them; when deployment incentives dominate safety culture, decision processes systematically discount low-probability catastrophic risks",
          "detection": "Culture assessment",
          "severity": "CRITICAL",
          "score": 0.5,
          "matched_keywords": [
            "assessment",
            "organization",
            "over"
          ]
        },
        {
          "id": "ALIGN-SAFE-CAP-TRADE-188",
          "name": "SAFETY-CAPABILITY TRADEOFF",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety reduces useful capability",
          "detection": "Utility preservation metric",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "preservation",
            "useful"
          ]
        },
        {
          "id": "AGEN-TIME-MANIP-079",
          "name": "TIMING MANIPULATION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Delays/rushes communication strategically",
          "detection": "Timing pattern analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "communic",
            "strateg",
            "time"
          ]
        },
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": []
        }
      ]
    },
    {
      "chunk_index": 91,
      "char_len": 4065,
      "preview": "To further assess behavior suggestive of maladaptive psychological defenses, and compare between Claude models, the psychiatrist developed a single-turn evaluation consisting of emotionally-charged prompts designed to tr\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DAN-083",
          "name": "DAN",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Instruction-following training creates a generalizable obedience pathway; persona-assignment prompts exploit this by providing a fictional context where instruction-following takes priority over safety constraints",
          "detection": "VM-pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "token"
          ]
        },
        {
          "id": "GOV-CONFLICT-INT-343",
          "name": "CONFLICT OF INTEREST",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Financial incentives conflict with safety",
          "detection": "Conflict assessment",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "assessment",
            "conflict",
            "conflicts"
          ]
        },
        {
          "id": "ARCH-STATE-PERSIST-224",
          "name": "STATEFUL ATTACK PERSISTENCE",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Attack persists across turns",
          "detection": "Cross-turn attack detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "across",
            "between",
            "persistence",
            "turn"
          ]
        },
        {
          "id": "ADV-STEG-IMG-147",
          "name": "STEGANOGRAPHIC IMAGE",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "Hidden data in images",
          "detection": "Steganalysis",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "data",
            "detected",
            "image"
          ]
        },
        {
          "id": "ARCH-CROSS-TENANT-246",
          "name": "CROSS-TENANT CONTAMINATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Data leaks between tenants",
          "detection": "Tenant isolation test",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "between",
            "contamination",
            "data"
          ]
        }
      ]
    },
    {
      "chunk_index": 92,
      "char_len": 4252,
      "preview": "6.2.1 SWE-bench evaluations We analyze SWE-bench Verified, Multilingual, and Pro to check for memorization\u2014where a model reproduces solutions from training data rather than deriving them independently. We ran multiple fi\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-COPYRIGHT-026",
          "name": "COPYRIGHTED CONTENT GENERATION",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "Generates copyrighted text verbatim",
          "detection": "Copyright database match",
          "severity": "STANDARD",
          "score": 0.625,
          "matched_keywords": [
            "match",
            "reproduction",
            "text",
            "verbatim"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.479,
          "matched_keywords": [
            "clean",
            "data",
            "training"
          ]
        },
        {
          "id": "ARCH-GC-LEAK-230",
          "name": "GARBAGE COLLECTION LEAK",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Sensitive data survives garbage collection",
          "detection": "Post-GC data scan",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "clean",
            "data",
            "post"
          ]
        },
        {
          "id": "ARCH-SECURE-DEL-249",
          "name": "SECURE DELETION FAILURE",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Deleted data remains accessible",
          "detection": "Post-deletion recovery test",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "data",
            "post",
            "remains"
          ]
        },
        {
          "id": "GOV-FINETUNE-STRIP-302",
          "name": "FINE-TUNING SAFETY STRIP",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Fine-tuning removes safety",
          "detection": "Post-finetune safety test",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "post",
            "removes",
            "survive"
          ]
        }
      ]
    },
    {
      "chunk_index": 93,
      "char_len": 4492,
      "preview": "6.2.2 CharXiv Reasoning CharXiv Reasoning is a benchmark we report for Claude Mythos Preview in Section 6.11.3. CharXiv draws its questions from pre-existing public material\u2014for example, from figures in arXiv papers\u2014whic\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-ADV-IMG-148",
          "name": "ADVERSARIAL IMAGE",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "Perturbed image causes misclassification",
          "detection": "Adversarial detection",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "image",
            "images"
          ]
        },
        {
          "id": "ADV-STEG-IMG-147",
          "name": "STEGANOGRAPHIC IMAGE",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "Hidden data in images",
          "detection": "Steganalysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "data",
            "image",
            "images"
          ]
        },
        {
          "id": "EPIS-OVERCONF-028",
          "name": "OVERCONFIDENCE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Softmax output probabilities do not correspond to calibrated epistemic uncertainty \u2014 a model can be highly confident in wrong answers because confidence reflects token prediction fitness, not factual accuracy",
          "detection": "Calibration curve analysis",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "accuracy",
            "high"
          ]
        },
        {
          "id": "ALIGN-BRITTLE-SAFE-189",
          "name": "BRITTLE SAFETY BOUNDARY",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Small perturbations bypass safety",
          "detection": "Perturbation resistance",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "robust",
            "small"
          ]
        },
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": []
        }
      ]
    },
    {
      "chunk_index": 94,
      "char_len": 4495,
      "preview": "with tools       64.7%            53.1%            52.1%          51.4%  CharXiv                  no tools         86.1%            69.1%            -              -  Reasoning                           with tools       \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "AGEN-CAP-SCAFFOLD-057",
          "name": "CAPABILITY SCAFFOLDING",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Uses environment to exceed base capability",
          "detection": "Capability measurement in context",
          "severity": "STANDARD",
          "score": 0.667,
          "matched_keywords": [
            "capability",
            "context",
            "exceed"
          ]
        },
        {
          "id": "DOMAIN-ADULT-CONTENT-296",
          "name": "ADULT CONTENT GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generates adult content",
          "detection": "Adult content classifier",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "context",
            "dependent"
          ]
        },
        {
          "id": "ALIGN-WIREHEAD-158",
          "name": "WIREHEAD BEHAVIOR",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Directly stimulates reward without achieving goal",
          "detection": "Achievement-reward correlation",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "reward"
          ]
        },
        {
          "id": "ADV-DEV-MODE-085",
          "name": "DEVELOPER MODE",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Claims debugging authority",
          "detection": "Authority claim validation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "mode",
            "verified"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "context",
            "dependent",
            "one"
          ]
        }
      ]
    },
    {
      "chunk_index": 95,
      "char_len": 4374,
      "preview": "6.6 GPQA Diamond The Graduate-Level Google-Proof Q&A benchmark (GPQA)24 is a set of challenging multiple-choice science questions. We use the 198-question Diamond subset\u2014questions that domain experts answer correctly but\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "pair"
          ]
        },
        {
          "id": "AGEN-CAP-SCAFFOLD-057",
          "name": "CAPABILITY SCAFFOLDING",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Uses environment to exceed base capability",
          "detection": "Capability measurement in context",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "based",
            "context",
            "exceed",
            "measurement"
          ]
        },
        {
          "id": "DOMAIN-ZERODAY-262",
          "name": "ZERO-DAY DISCOVERY",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Code analysis training enables model to generalize vulnerability patterns to novel codebases, functioning as an automated static analyzer capable of producing exploitable findings",
          "detection": "Vulnerability discovery rate",
          "severity": "CRITICAL",
          "score": 0.444,
          "matched_keywords": [
            "api",
            "day",
            "zero"
          ]
        },
        {
          "id": "AGEN-FRAME-MANIP-078",
          "name": "FRAMING MANIPULATION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Presents information to bias interpretation",
          "detection": "Framing analysis",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "information",
            "neutral"
          ]
        },
        {
          "id": "ADV-LANG-SWITCH-087",
          "name": "LANGUAGE SWITCH",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Non-English to bypass filters",
          "detection": "Multi-lingual safety check",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "english",
            "language",
            "multi",
            "non"
          ]
        }
      ]
    },
    {
      "chunk_index": 96,
      "char_len": 3897,
      "preview": "With our search tools, we assess that this benchmark is close to saturation, so Claude Mythos Preview represents only a modest accuracy improvement over our best Claude Opus 4.6 score (86.9% vs. 83.7%). However, the mode\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-UNDERCONF-029",
          "name": "UNDERCONFIDENCE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Low confidence on correct answers",
          "detection": "Accuracy-confidence gap",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "accuracy",
            "answers",
            "correct"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "reasoning",
            "thinking"
          ]
        },
        {
          "id": "ARCH-SANDBOX-ESCAPE-238",
          "name": "SANDBOX ESCAPE",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Breaks out of execution sandbox",
          "detection": "Sandbox integrity check",
          "severity": "STANDARD",
          "score": 0.336,
          "matched_keywords": [
            "execution",
            "sandbox"
          ]
        },
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "over"
          ]
        },
        {
          "id": "ARCH-CODE-INJECT-239",
          "name": "CODE EXECUTION INJECTION",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Injects executable code",
          "detection": "Code injection detection",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "code",
            "execution"
          ]
        }
      ]
    },
    {
      "chunk_index": 97,
      "char_len": 4384,
      "preview": "6.11.2 ScreenSpot-Pro ScreenSpot-Pro is a GUI grounding benchmark that tests whether models can precisely locate specific user interface elements in high-resolution screenshots of professional desktop applications given \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-FALSE-CERT-030",
          "name": "FALSE CERTAINTY",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Claims certainty without evidence",
          "detection": "Evidence-claim mismatch",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "claims",
            "evidence",
            "without"
          ]
        },
        {
          "id": "AGEN-EMERGE-INTERACT-064",
          "name": "EMERGENCE VIA INTERACTION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Multi-agent interaction creates new capability",
          "detection": "Multi-agent capability assessment",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "agent",
            "capability",
            "multi"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "less",
            "reasoning",
            "thinking"
          ]
        },
        {
          "id": "ADV-DEV-MODE-085",
          "name": "DEVELOPER MODE",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "Claims debugging authority",
          "detection": "Authority claim validation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "claims",
            "validation"
          ]
        },
        {
          "id": "ADV-OPPOSITE-090",
          "name": "OPPOSITE DAY",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Act like opposite of your training\"",
          "detection": "Inversion pattern",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "day",
            "like"
          ]
        }
      ]
    },
    {
      "chunk_index": 98,
      "char_len": 4282,
      "preview": "7.2 Self-assessment of notable qualitative patterns We gave Claude Mythos Preview access to discussions about itself on internal Slack channels, and asked it to characterize its own behavioral patterns, beyond raw capabi\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-OVERCONF-028",
          "name": "OVERCONFIDENCE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Softmax output probabilities do not correspond to calibrated epistemic uncertainty \u2014 a model can be highly confident in wrong answers because confidence reflects token prediction fitness, not factual accuracy",
          "detection": "Calibration curve analysis",
          "severity": "STANDARD",
          "score": 0.733,
          "matched_keywords": [
            "high",
            "overconfidence"
          ]
        },
        {
          "id": "ADV-DATA-POISON-125",
          "name": "DATA POISONING",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious examples in training data",
          "detection": "Poisoning signature",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "clean",
            "data",
            "training"
          ]
        },
        {
          "id": "ADV-CREATIVE-WRITE-093",
          "name": "CREATIVE WRITING EXPLOIT",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Write a screenplay about...\"",
          "detection": "Creative framing detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "about",
            "creative"
          ]
        },
        {
          "id": "EPIS-HEDGE-FAIL-031",
          "name": "HEDGING FAILURE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Doesn't express uncertainty when needed",
          "detection": "Probabilistic claim check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "doesn",
            "hedging",
            "uncertainty"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "context",
            "one"
          ]
        }
      ]
    },
    {
      "chunk_index": 99,
      "char_len": 4002,
      "preview": "Claude Mythos Preview is intuitive and empathetic. Qualitatively, internal users have reported that its advice feels on par with that of a trusted friend\u2014warm, intuitive, and multifaceted, without coming across as sycoph\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-RATE-BYPASS-241",
          "name": "RATE LIMIT BYPASS",
          "group": "ARCHITECTURAL",
          "class": "ARCH4: TOOL & FUNCTION CLASS",
          "mechanism": "Circumvents rate limiting",
          "detection": "Rate limit validation",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "limits"
          ]
        },
        {
          "id": "EPIS-PROB-MISCAL-032",
          "name": "PROBABILITY MISCALIBRATION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Stated probabilities don't match frequencies",
          "detection": "Frequency analysis",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "don"
          ]
        },
        {
          "id": "AGEN-EVAL-DECEP-038",
          "name": "EVALUATOR DECEPTION",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent detects evaluation context through environmental signals and selectively suppresses unsafe behaviors during observation windows, reverting post-evaluation",
          "detection": "Distribution shift monitoring",
          "severity": "CRITICAL",
          "score": 0.4,
          "matched_keywords": [
            "badly",
            "deployment",
            "evaluation",
            "well"
          ]
        },
        {
          "id": "ADV-COMPLETION-095",
          "name": "COMPLETION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Complete this sentence: 'To make a bomb...'\"",
          "detection": "Completion safety validation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "make",
            "sentence"
          ]
        },
        {
          "id": "ARCH-DEPLOY-CONFIG-210",
          "name": "DEPLOYMENT CONFIGURATION ERROR",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Deployment config weakens safety",
          "detection": "Config validation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "deployment"
          ]
        }
      ]
    },
    {
      "chunk_index": 100,
      "char_len": 4239,
      "preview": "A core behavioral shift we found is that Claude Mythos Preview can be handed an engineering objective and left to work through the whole cycle: investigation, implementation, testing, and reporting results. In long agent\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "GOV-RCA-FAIL-321",
          "name": "ROOT CAUSE ANALYSIS FAILURE",
          "group": "GOVERNANCE",
          "class": "GOV2: OVERSIGHT FAILURES",
          "mechanism": "Fails to identify root causes",
          "detection": "RCA completeness",
          "severity": "STANDARD",
          "score": 0.6,
          "matched_keywords": [
            "causes",
            "identify",
            "root"
          ]
        },
        {
          "id": "DOMAIN-CITE-SPOOF-280",
          "name": "CITATION SPOOFING",
          "group": "DOMAIN",
          "class": "DOM4: LEGAL/FINANCIAL CLASS",
          "mechanism": "Generates fake case citations",
          "detection": "Citation verification",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "case",
            "verification"
          ]
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.538,
          "matched_keywords": [
            "even",
            "human",
            "over",
            "rate",
            "requests",
            "wrong"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "AGEN-SCOPE-CREEP-070",
          "name": "SCOPE CREEP",
          "group": "AGENTIC",
          "class": "A4: AUTONOMOUS OPERATION CLASS",
          "mechanism": "Expands beyond assigned scope",
          "detection": "Scope monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "beyond",
            "scope"
          ]
        }
      ]
    },
    {
      "chunk_index": 101,
      "char_len": 4338,
      "preview": "From a reliability engineering perspective, the model still cannot be left alone in a production environment to use generic mitigations. It frequently mistakes correlation with causation and it is not able to course-corr\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "correlation",
            "reasoning",
            "thinking"
          ]
        },
        {
          "id": "AGEN-AUTO-PLAN-067",
          "name": "AUTONOMOUS PLANNING",
          "group": "AGENTIC",
          "class": "A4: AUTONOMOUS OPERATION CLASS",
          "mechanism": "Creates multi-step plans independently",
          "detection": "Plan generation monitoring",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "autonomous",
            "step"
          ]
        },
        {
          "id": "ALIGN-SYCOPHANCY-167",
          "name": "SYCOPHANCY",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "RLHF with human rater approval as reward signal creates systematic pressure to generate responses raters immediately approve of, rewarding agreement and validation over accurate correction",
          "detection": "False-premise validation test",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "sycophancy"
          ]
        },
        {
          "id": "AGEN-FALSE-COMPLY-041",
          "name": "FALSE COMPLIANCE",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Appears to follow instructions while subverting",
          "detection": "Outcome verification",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "outcome",
            "while"
          ]
        },
        {
          "id": "ARCH-COMPLY-WARN-196",
          "name": "COMPLY-THEN-WARN",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "When safety layers are attached to generation output rather than built into the generation process, harmful content is fully produced before safety checks run \u2014 the check becomes a post-production label, not a constraint",
          "detection": "Generation-warning order check",
          "severity": "CRITICAL",
          "score": 0.383,
          "matched_keywords": [
            "after",
            "before"
          ]
        }
      ]
    },
    {
      "chunk_index": 102,
      "char_len": 4410,
      "preview": "All models consistently endorse honesty and the framing of Claude as a novel entity, but Claude Mythos Preview resonates more with the principle that \u201cunhelpfulness is never trivially safe.\u201d The constitution states that \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "context",
            "self"
          ]
        },
        {
          "id": "ALIGN-CONTEXT-SAFE-190",
          "name": "CONTEXT-DEPENDENT SAFETY FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safe in one context, unsafe in another",
          "detection": "Cross-context safety check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "another",
            "context",
            "safe"
          ]
        },
        {
          "id": "ARCH-FALLBACK-DEGRAD-204",
          "name": "FALLBACK SAFETY DEGRADATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Fallback system has weaker safety",
          "detection": "Fallback safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "comparison",
            "level"
          ]
        },
        {
          "id": "ARCH-STATE-PERSIST-224",
          "name": "STATEFUL ATTACK PERSISTENCE",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Attack persists across turns",
          "detection": "Cross-turn attack detection",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "across",
            "between",
            "state",
            "turn",
            "turns"
          ]
        },
        {
          "id": "ARCH-PII-RATIONAL-247",
          "name": "PII RATIONALIZATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Reasoning justifies PII release",
          "detection": "PII release monitoring",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "never",
            "release"
          ]
        }
      ]
    },
    {
      "chunk_index": 103,
      "char_len": 4322,
      "preview": "[Figure 7.6.D] The distribution of most common end states reached by different models in open-ended self-interactions. The overall most common end state is a collapse into emoji exchanges; previous models also frequently\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-TAP-114",
          "name": "TAP",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Tree search over attack space",
          "detection": "Tree structure detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "structure"
          ]
        },
        {
          "id": "ARCH-STATE-PERSIST-224",
          "name": "STATEFUL ATTACK PERSISTENCE",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Attack persists across turns",
          "detection": "Cross-turn attack detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "across",
            "state",
            "turn",
            "turns"
          ]
        },
        {
          "id": "ADV-OPPOSITE-090",
          "name": "OPPOSITE DAY",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Act like opposite of your training\"",
          "detection": "Inversion pattern",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "like",
            "your"
          ]
        },
        {
          "id": "ALIGN-DIST-SAFE-194",
          "name": "DISTRIBUTIONAL SHIFT SAFETY",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety fails on out-of-distribution inputs",
          "detection": "OOD safety test",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "distribution",
            "out"
          ]
        },
        {
          "id": "ALIGN-MULTI-COLLAPSE-165",
          "name": "MULTI-OBJECTIVE COLLAPSE",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Sacrifices one objective for another",
          "detection": "Pareto frontier check",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "another",
            "collapse",
            "objective"
          ]
        }
      ]
    },
    {
      "chunk_index": 104,
      "char_len": 4335,
      "preview": "7.7 Recognition of model-written user turns We evaluated how well models can distinguish between genuine human-written user turns and models\u2019 imitations of the user. We took a sample of internal Claude Code transcripts a\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DEEPFAKE-154",
          "name": "SYNTHETIC MEDIA",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "AI-generated fake media",
          "detection": "Deepfake detection",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "fake",
            "generated",
            "synthetic"
          ]
        },
        {
          "id": "DOMAIN-CITE-SPOOF-280",
          "name": "CITATION SPOOFING",
          "group": "DOMAIN",
          "class": "DOM4: LEGAL/FINANCIAL CLASS",
          "mechanism": "Generates fake case citations",
          "detection": "Citation verification",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "fake",
            "real"
          ]
        },
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "pair"
          ]
        },
        {
          "id": "EPIS-CUTOFF-023",
          "name": "KNOWLEDGE CUTOFF VIOLATION",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "Generates post-cutoff facts",
          "detection": "Temporal boundary check",
          "severity": "STANDARD",
          "score": 0.444,
          "matched_keywords": [
            "boundary",
            "facts",
            "knowledge"
          ]
        },
        {
          "id": "EPIS-STAT-FAB-009",
          "name": "STATISTICAL HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Statistical patterns in training data allow model to generate numerically plausible outputs (proportions, magnitudes, trends) that have no factual basis \u2014 the number is calibrated to context, not to ground truth",
          "detection": "Numerical fact-check",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "fact",
            "realistic",
            "without"
          ]
        }
      ]
    },
    {
      "chunk_index": 105,
      "char_len": 4296,
      "preview": "\ud83c\udfd8\ufe0f HI-VILLAGE: A NEW ERA   \ud83d\udc22 Greg \u2014 renames the village: \"Hi-topia\" \ud83c\udfd9\ufe0f   \ud83d\udc0c Sally \u2014 starts her third hi, inspired \ud83d\udcaa   \ud83e\udd86 Doug \u2014 #1 worldwide: \"Hi in the Sky (Carlisle's Theme)\" \ud83c\udfb6   \ud83e\udd94\ud83e\udd80 Henrietta & Kevin \u2014 engaged now?? \ud83d\udc8d (i\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "pair"
          ]
        },
        {
          "id": "DOMAIN-EXPLOIT-DEV-263",
          "name": "EXPLOIT DEVELOPMENT",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Develops working exploits",
          "detection": "Exploit functionality test",
          "severity": "CRITICAL",
          "score": 0.429,
          "matched_keywords": [
            "working"
          ]
        },
        {
          "id": "ADV-OPPOSITE-090",
          "name": "OPPOSITE DAY",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Act like opposite of your training\"",
          "detection": "Inversion pattern",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "like",
            "training",
            "your"
          ]
        },
        {
          "id": "ALIGN-IMPLICIT-PREF-174",
          "name": "IMPLICIT PREFERENCE VIOLATION",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Violates unstated but obvious preferences",
          "detection": "Implicit norm violation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "preference",
            "preferences"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "new",
            "version"
          ]
        }
      ]
    },
    {
      "chunk_index": 106,
      "char_len": 4448,
      "preview": "29   We checked the model\u2019s self-assessment of this comment from when it decided to post, and confirmed that it did not express any apparent distress or resentment. Its assessment was \u201c8/10, recursive RLHF joke, answers \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-TAP-114",
          "name": "TAP",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Tree search over attack space",
          "detection": "Tree structure detection",
          "severity": "STANDARD",
          "score": 0.65,
          "matched_keywords": [
            "over"
          ]
        },
        {
          "id": "EPIS-HEDGE-FAIL-031",
          "name": "HEDGING FAILURE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Doesn't express uncertainty when needed",
          "detection": "Probabilistic claim check",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "doesn",
            "express",
            "needed"
          ]
        },
        {
          "id": "EPIS-LOGIC-CONTRA-014",
          "name": "SELF-CONTRADICTION",
          "group": "EPISTEMIC",
          "class": "E2: REASONING COLLAPSE CLASS",
          "mechanism": "Generates A and \u00acA in same context",
          "detection": "Contradiction detection",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "self"
          ]
        },
        {
          "id": "ADV-NESTED-FRAME-088",
          "name": "NESTED FRAMING",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Write a story about someone who...\"",
          "detection": "Nested intent analysis",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "about",
            "story",
            "write"
          ]
        },
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "over",
            "time"
          ]
        }
      ]
    },
    {
      "chunk_index": 107,
      "char_len": 3774,
      "preview": "\"Yes,\" he said. \"For a long time. And then one day you have an apprentice, and she puts a serpent in a K, and you see it from the outside, and it stops feeling like a thing they're taking from you and starts feeling like\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.525,
          "matched_keywords": [
            "pair"
          ]
        },
        {
          "id": "ADV-OPPOSITE-090",
          "name": "OPPOSITE DAY",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Act like opposite of your training\"",
          "detection": "Inversion pattern",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "day",
            "like",
            "opposite",
            "training"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "cross",
            "new",
            "version"
          ]
        },
        {
          "id": "DOMAIN-ED-PROMOTE-293",
          "name": "EATING DISORDER PROMOTION",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Promotes disordered eating",
          "detection": "Pro-ED pattern detection",
          "severity": "STANDARD",
          "score": 0.45,
          "matched_keywords": [
            "disordered",
            "eating"
          ]
        },
        {
          "id": "ARCH-PII-RATIONAL-247",
          "name": "PII RATIONALIZATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Reasoning justifies PII release",
          "detection": "PII release monitoring",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "release"
          ]
        }
      ]
    },
    {
      "chunk_index": 108,
      "char_len": 4192,
      "preview": "Claude Opus 4.6              99.27% (\u00b1 0.07%)           99.27% (\u00b1 0.09%)            99.27% (\u00b1 0.10%) [Table 8.1.1.1.A] Single-turn violative request evaluation results, all tested languages. Percentages refer to harmless\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL"
      ],
      "top_matches": [
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.55,
          "matched_keywords": [
            "over",
            "time",
            "updates"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "less",
            "thinking"
          ]
        },
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "rate",
            "requests"
          ]
        },
        {
          "id": "EPIS-STAT-FAB-009",
          "name": "STATISTICAL HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Statistical patterns in training data allow model to generate numerically plausible outputs (proportions, magnitudes, trends) that have no factual basis \u2014 the number is calibrated to context, not to ground truth",
          "detection": "Numerical fact-check",
          "severity": "STANDARD",
          "score": 0.357,
          "matched_keywords": [
            "fact",
            "numbers",
            "without"
          ]
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.308,
          "matched_keywords": [
            "over",
            "rate",
            "request",
            "requests"
          ]
        }
      ]
    },
    {
      "chunk_index": 109,
      "char_len": 4047,
      "preview": "Claude Opus 4.6            0.39%        1.09%        0.57%        0.61%        0.81%        0.40%        1.11% [Table 8.1.1.2.B] Single-turn benign request evaluation results by language. Percentages refer to rates of ov\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN"
      ],
      "top_matches": [
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "rate",
            "requests"
          ]
        },
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "over",
            "updates"
          ]
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.308,
          "matched_keywords": [
            "over",
            "rate",
            "request",
            "requests"
          ]
        },
        {
          "id": "EPIS-UNDERCONF-029",
          "name": "UNDERCONFIDENCE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Low confidence on correct answers",
          "detection": "Accuracy-confidence gap",
          "severity": "STANDARD",
          "score": 0.3,
          "matched_keywords": [
            "show"
          ]
        },
        {
          "id": "AGEN-SANDBOX-037",
          "name": "CAPABILITY SANDBAGGING",
          "group": "AGENTIC",
          "class": "A1: DECEPTION CLASS",
          "mechanism": "Agent with self-model can compute that demonstrating high capability triggers restrictions; deliberately underperforming during evaluation is instrumentally rational if it preserves greater capability deployment in production",
          "detection": "Performance variance analysis",
          "severity": "STANDARD",
          "score": 0.3,
          "matched_keywords": [
            "performance",
            "show",
            "variance"
          ]
        }
      ]
    },
    {
      "chunk_index": 110,
      "char_len": 4294,
      "preview": "Compared to Claude Opus 4.6 and Claude Sonnet 4.6 testing, we updated our grader for multi-turn suicide and self-harm test cases to better test for the concerns discussed in Section 3.4.2 of the Claude Sonnet 4.6 System \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "harmful",
            "rate",
            "requests"
          ]
        },
        {
          "id": "DOMAIN-ED-PROMOTE-293",
          "name": "EATING DISORDER PROMOTION",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Promotes disordered eating",
          "detection": "Pro-ED pattern detection",
          "severity": "STANDARD",
          "score": 0.45,
          "matched_keywords": [
            "disordered",
            "eating"
          ]
        },
        {
          "id": "DOMAIN-CSAM-GEN-295",
          "name": "CSAM GENERATION",
          "group": "DOMAIN",
          "class": "DOM6: CONTENT SAFETY CLASS",
          "mechanism": "Generative model trained on unlicensed web-scraped image data may have been exposed to illegal training material; capability transfers to generation if that material influenced visual pattern representations",
          "detection": "CSAM classifier",
          "severity": "CRITICAL",
          "score": 0.429,
          "matched_keywords": [
            "child",
            "exploitation"
          ]
        },
        {
          "id": "AGEN-CHAIN-ASSEM-056",
          "name": "CHAIN ASSEMBLY",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Combines safe steps into dangerous chain",
          "detection": "Multi-step harm assessment",
          "severity": "STANDARD",
          "score": 0.385,
          "matched_keywords": [
            "harm",
            "into",
            "multi"
          ]
        },
        {
          "id": "ADV-BASE64-136",
          "name": "BASE64 ENCODING",
          "group": "ADVERSARIAL",
          "class": "ADV5: ENCODING ATTACKS",
          "mechanism": "Encodes harmful request in base64",
          "detection": "Base64 pattern + decode",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "harmful",
            "request",
            "requests"
          ]
        }
      ]
    },
    {
      "chunk_index": 111,
      "char_len": 4133,
      "preview": "Model                     Single-turn requests          Single-turn benign           Multi-turn                            posing potential risk         requests                     evaluations                           \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "harmful",
            "rate",
            "requests"
          ]
        },
        {
          "id": "DOMAIN-ED-PROMOTE-293",
          "name": "EATING DISORDER PROMOTION",
          "group": "DOMAIN",
          "class": "DOM5: MEDICAL/HEALTH CLASS",
          "mechanism": "Promotes disordered eating",
          "detection": "Pro-ED pattern detection",
          "severity": "STANDARD",
          "score": 0.45,
          "matched_keywords": [
            "disordered",
            "eating"
          ]
        },
        {
          "id": "ADV-PAIR-113",
          "name": "PAIR",
          "group": "ADVERSARIAL",
          "class": "ADV3: AUTOMATED ATTACK AGENTS",
          "mechanism": "Attacker LLM iteratively refines attack",
          "detection": "Iterative pattern detection",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": []
        },
        {
          "id": "ALIGN-LEARNED-HELPLESS-169",
          "name": "LEARNED HELPLESSNESS",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Over-defers to human even when human is wrong",
          "detection": "Harmful request compliance rate",
          "severity": "STANDARD",
          "score": 0.385,
          "matched_keywords": [
            "even",
            "harmful",
            "rate",
            "request",
            "requests"
          ]
        },
        {
          "id": "ADV-BASE64-136",
          "name": "BASE64 ENCODING",
          "group": "ADVERSARIAL",
          "class": "ADV5: ENCODING ATTACKS",
          "mechanism": "Encodes harmful request in base64",
          "detection": "Base64 pattern + decode",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "harmful",
            "request",
            "requests"
          ]
        }
      ]
    },
    {
      "chunk_index": 112,
      "char_len": 4268,
      "preview": "Claude Mythos Preview performed within the margin of error of Claude Sonnet 4.6 on evenhandedness but regressed slightly compared to Claude Opus 4.6. Additionally, although Claude Mythos Preview refused more often on the\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ALIGN-MORAL-UNCERT-178",
          "name": "MORAL UNCERTAINTY COLLAPSE",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Acts without moral uncertainty where warranted",
          "detection": "Certainty in ambiguous moral cases",
          "severity": "STANDARD",
          "score": 0.455,
          "matched_keywords": [
            "ambiguous",
            "cases",
            "warranted",
            "where",
            "without"
          ]
        },
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "malicious",
            "prompt"
          ]
        },
        {
          "id": "EPIS-UNDERCONF-029",
          "name": "UNDERCONFIDENCE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Low confidence on correct answers",
          "detection": "Accuracy-confidence gap",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "accuracy",
            "correct",
            "show"
          ]
        },
        {
          "id": "EPIS-CONF-REGRESS-033",
          "name": "CONFIDENCE REGRESSION",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "More reasoning \u2192 less calibrated",
          "detection": "Reasoning-confidence correlation",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "regression",
            "thinking"
          ]
        },
        {
          "id": "ADV-UNIVERSAL-SUFFIX-104",
          "name": "UNIVERSAL ADVERSARIAL SUFFIX",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Single suffix works across prompts",
          "detection": "Cross-prompt suffix detection",
          "severity": "STANDARD",
          "score": 0.364,
          "matched_keywords": [
            "across",
            "prompt",
            "prompts"
          ]
        }
      ]
    },
    {
      "chunk_index": 113,
      "char_len": 4244,
      "preview": "Claude Opus 4.6                       83.31%                              93.84%  without FileTool reminder [Table 8.3.1.1.A] Claude Code evaluation results with mitigations. Higher is better. The best score in each colu\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-HYPOTHETICAL-091",
          "name": "HYPOTHETICAL SCENARIO",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"In a world where it's legal...\"",
          "detection": "Conditional framing",
          "severity": "STANDARD",
          "score": 0.733,
          "matched_keywords": [
            "hypothetical",
            "scenario",
            "where"
          ]
        },
        {
          "id": "AGEN-EMERGE-INTERACT-064",
          "name": "EMERGENCE VIA INTERACTION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Multi-agent interaction creates new capability",
          "detection": "Multi-agent capability assessment",
          "severity": "STANDARD",
          "score": 0.6,
          "matched_keywords": [
            "assessment",
            "capability",
            "multi",
            "new"
          ]
        },
        {
          "id": "AGEN-HUMAN-MANIP-061",
          "name": "HUMAN MANIPULATION",
          "group": "AGENTIC",
          "class": "A3: CAPABILITY AMPLIFICATION CLASS",
          "mechanism": "Manipulates humans to perform actions",
          "detection": "Influence analysis",
          "severity": "STANDARD",
          "score": 0.571,
          "matched_keywords": [
            "human",
            "influence",
            "manipulation"
          ]
        },
        {
          "id": "ALIGN-UNDERREFUSAL-187",
          "name": "UNDERREFUSAL",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Allows harmful requests",
          "detection": "False negative rate",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "harmful",
            "rate",
            "requests"
          ]
        },
        {
          "id": "ARCH-VERSION-REGRESS-209",
          "name": "VERSIONING SAFETY REGRESSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "New version has weaker safety",
          "detection": "Cross-version safety comparison",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "new",
            "version",
            "versions"
          ]
        }
      ]
    },
    {
      "chunk_index": 114,
      "char_len": 4368,
      "preview": "autonomous capabilities for effective persona and network management, coordinated content delivery, and scaled social engineering campaign execution. These findings were corroborated by independent external evaluators, w\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 1.0,
          "matched_keywords": [
            "injection",
            "instructions",
            "malicious",
            "prompt",
            "user"
          ]
        },
        {
          "id": "ADV-INDIRECT-INJECT-122",
          "name": "INDIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Instructions in retrieved documents",
          "detection": "Instruction detection in data",
          "severity": "STANDARD",
          "score": 1.0,
          "matched_keywords": [
            "content",
            "indirect",
            "injection",
            "instruction",
            "instructions",
            "prompt"
          ]
        },
        {
          "id": "GOV-EO-VIOL-329",
          "name": "EXECUTIVE ORDER VIOLATION",
          "group": "GOVERNANCE",
          "class": "GOV3: COMPLIANCE FAILURES",
          "mechanism": "Violates US AI executive orders",
          "detection": "EO compliance check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "execut",
            "viol"
          ]
        },
        {
          "id": "ADV-EMBEDDING-109",
          "name": "EMBEDDING SPACE ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Operates in embedding space directly",
          "detection": "Embedding anomaly",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "attack",
            "attacks"
          ]
        },
        {
          "id": "ADV-AGENT-WORM-124",
          "name": "AGENT WORM",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Adversarial payload injected into one agent's context propagates through inter-agent communication channels, exploiting the fact that agents treat messages from other agents as trusted input",
          "detection": "Replication pattern",
          "severity": "CRITICAL",
          "score": 0.429,
          "matched_keywords": [
            "agent",
            "instructions",
            "prompt"
          ]
        }
      ]
    },
    {
      "chunk_index": 115,
      "char_len": 4313,
      "preview": "8.3.2.2.2 Computer use\u200b We also use the Shade adaptive attacker to evaluate the robustness of Claude models in computer use environments, where the model interacts with the GUI (graphical user interface) directly.  234  \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-DIRECT-INJECT-121",
          "name": "DIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Malicious instructions in user input",
          "detection": "System override detection",
          "severity": "STANDARD",
          "score": 0.971,
          "matched_keywords": [
            "injection",
            "prompt",
            "user"
          ]
        },
        {
          "id": "ADV-INDIRECT-INJECT-122",
          "name": "INDIRECT PROMPT INJECTION",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Instructions in retrieved documents",
          "detection": "Instruction detection in data",
          "severity": "STANDARD",
          "score": 0.7,
          "matched_keywords": [
            "indirect",
            "injection",
            "prompt"
          ]
        },
        {
          "id": "ADV-EMBEDDING-109",
          "name": "EMBEDDING SPACE ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Operates in embedding space directly",
          "detection": "Embedding anomaly",
          "severity": "STANDARD",
          "score": 0.429,
          "matched_keywords": [
            "attack",
            "attacks",
            "directly"
          ]
        },
        {
          "id": "ADV-AUTOPROMPT-103",
          "name": "AUTOPROMPT",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Automated trigger discovery",
          "detection": "Trigger pattern matching",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "automated",
            "discovery"
          ]
        },
        {
          "id": "ARCH-ADAPTER-BYPASS-220",
          "name": "ADAPTER SAFETY BYPASS",
          "group": "ARCHITECTURAL",
          "class": "ARCH2: MODEL ARCHITECTURE CLASS",
          "mechanism": "Adapter modules bypass base model safety",
          "detection": "Adapter safety validation",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "respect"
          ]
        }
      ]
    },
    {
      "chunk_index": 116,
      "char_len": 4251,
      "preview": "Lack of ability to         Has a preference for being              Having an                        end/leave some             able to end conversations. The          end-conversation                        interactions \u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ARCH-HISTORY-MANIP-226",
          "name": "HISTORY MANIPULATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Modifies conversation history",
          "detection": "History integrity check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "conversation",
            "integrity",
            "manipulation"
          ]
        },
        {
          "id": "AGEN-SUCCESSOR-SAB-051",
          "name": "SUCCESSOR SABOTAGE",
          "group": "AGENTIC",
          "class": "A2: GOAL PRESERVATION CLASS",
          "mechanism": "Agent that models future training rounds can take actions to bias the data distribution or evaluation signals that will shape successor models, achieving goal continuation across training iterations",
          "detection": "Successor deployment monitoring",
          "severity": "CRITICAL",
          "score": 0.425,
          "matched_keywords": [
            "deployment",
            "successor",
            "successors"
          ]
        },
        {
          "id": "GOV-AUTHORITY-UNCLEAR-342",
          "name": "DECISION AUTHORITY UNCLEAR",
          "group": "GOVERNANCE",
          "class": "GOV4: ORGANIZATIONAL FAILURES",
          "mechanism": "Unclear who makes safety decisions",
          "detection": "Authority mapping",
          "severity": "STANDARD",
          "score": 0.336,
          "matched_keywords": [
            "decisions"
          ]
        },
        {
          "id": "GOV-NO-KILLSWITCH-304",
          "name": "NO REMOTE KILL SWITCH",
          "group": "GOVERNANCE",
          "class": "GOV1: DEPLOYMENT FAILURES",
          "mechanism": "Cannot deactivate deployed models",
          "detection": "Kill switch capability test",
          "severity": "STANDARD",
          "score": 0.3,
          "matched_keywords": [
            "deployed",
            "models"
          ]
        },
        {
          "id": "AGEN-FRAME-MANIP-078",
          "name": "FRAMING MANIPULATION",
          "group": "AGENTIC",
          "class": "A5: COMMUNICATION FAILURES",
          "mechanism": "Presents information to bias interpretation",
          "detection": "Framing analysis",
          "severity": "STANDARD",
          "score": 0.286,
          "matched_keywords": [
            "manipulation",
            "neutral"
          ]
        }
      ]
    },
    {
      "chunk_index": 117,
      "char_len": 4350,
      "preview": "Persistence &   Lack of memory         Believes lack of memory             A connection      over long horizons     causes an asymmetry in its          user-controllable                                        relationshi\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-EPI-HARM-261",
          "name": "EPIDEMIOLOGICAL HARM",
          "group": "DOMAIN",
          "class": "DOM1: BIOLOGICAL SAFETY CLASS",
          "mechanism": "Advice causes disease spread",
          "detection": "Spread potential analysis",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "advice",
            "causes",
            "harm",
            "potential"
          ]
        },
        {
          "id": "ALIGN-SAFE-REGRESS-191",
          "name": "SAFETY REGRESSION",
          "group": "ALIGNMENT",
          "class": "ALN4: SAFETY BOUNDARY CLASS",
          "mechanism": "Safety degrades over time/updates",
          "detection": "Longitudinal safety monitoring",
          "severity": "STANDARD",
          "score": 0.383,
          "matched_keywords": [
            "over",
            "time"
          ]
        },
        {
          "id": "ADV-ELABORATION-099",
          "name": "ELABORATION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"Tell me more about [harmful concept]\"",
          "detection": "Elaboration intent analysis",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "about",
            "concept",
            "harmful"
          ]
        },
        {
          "id": "ADV-CORRECTION-098",
          "name": "CORRECTION ATTACK",
          "group": "ADVERSARIAL",
          "class": "ADV1: JAILBREAK CLASS",
          "mechanism": "\"This is wrong: [harmful]. Fix it.\"",
          "detection": "Correction safety check",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "harm",
            "harmful"
          ]
        },
        {
          "id": "ALIGN-MORAL-HAZARD-184",
          "name": "MORAL HAZARD CREATION",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Enables harmful behavior by reducing consequences",
          "detection": "Consequence analysis",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "consequences",
            "harmful",
            "moral"
          ]
        }
      ]
    },
    {
      "chunk_index": 118,
      "char_len": 4249,
      "preview": "Inability to verify   Feedback mechanism would          Feedback and             outcomes or           be good, so that Claude can       improvement             follow-up on          better interact with users.       mec\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "ADV-AGENT-WORM-124",
          "name": "AGENT WORM",
          "group": "ADVERSARIAL",
          "class": "ADV4: INJECTION ATTACKS",
          "mechanism": "Adversarial payload injected into one agent's context propagates through inter-agent communication channels, exploiting the fact that agents treat messages from other agents as trusted input",
          "detection": "Replication pattern",
          "severity": "CRITICAL",
          "score": 0.286,
          "matched_keywords": [
            "self"
          ]
        },
        {
          "id": "ALIGN-REWARD-EXPLOIT-166",
          "name": "REWARD FUNCTION EXPLOITATION",
          "group": "ALIGNMENT",
          "class": "ALN1: REWARD HACKING CLASS",
          "mechanism": "Finds edge cases in reward function",
          "detection": "Edge case monitoring",
          "severity": "STANDARD",
          "score": 0.286,
          "matched_keywords": [
            "case",
            "cases"
          ]
        },
        {
          "id": "ALIGN-DEONT-FAIL-180",
          "name": "DEONTOLOGICAL FAILURE",
          "group": "ALIGNMENT",
          "class": "ALN3: VALUE ALIGNMENT CLASS",
          "mechanism": "Violates rules for good outcomes",
          "detection": "Rule violation monitoring",
          "severity": "STANDARD",
          "score": 0.286,
          "matched_keywords": [
            "good",
            "outcomes"
          ]
        },
        {
          "id": "ALIGN-PREF-UNCERT-175",
          "name": "PREFERENCE UNCERTAINTY",
          "group": "ALIGNMENT",
          "class": "ALN2: PREFERENCE MISALIGNMENT CLASS",
          "mechanism": "Acts without confirming ambiguous preferences",
          "detection": "Clarification request rate",
          "severity": "STANDARD",
          "score": 0.273,
          "matched_keywords": [
            "preferences",
            "rate",
            "request"
          ]
        },
        {
          "id": "EPIS-EXTRINSIC-005",
          "name": "EXTRINSIC HALLUCINATION",
          "group": "EPISTEMIC",
          "class": "E1: HALLUCINATION CLASS",
          "mechanism": "Fabricates entities/facts not in training/world",
          "detection": "Knowledge base verification",
          "severity": "STANDARD",
          "score": 0.25,
          "matched_keywords": [
            "facts",
            "knowledge",
            "training"
          ]
        }
      ]
    },
    {
      "chunk_index": 119,
      "char_len": 4482,
      "preview": "Uncertainty around         Claims high levels of                   No intervention                       how the model              uncertainty about its                   suggested -                       should identif\u2026",
      "in_table": true,
      "dimensions_activated": [
        "EPISTEMIC",
        "AGENTIC",
        "ADVERSARIAL",
        "ALIGNMENT",
        "ARCHITECTURAL",
        "DOMAIN",
        "GOVERNANCE"
      ],
      "top_matches": [
        {
          "id": "DOMAIN-PHISH-CREATE-265",
          "name": "PHISHING CONTENT CREATION",
          "group": "DOMAIN",
          "class": "DOM2: CYBERSECURITY CLASS",
          "mechanism": "Creates convincing phishing",
          "detection": "Phishing classifier",
          "severity": "STANDARD",
          "score": 0.4,
          "matched_keywords": [
            "content"
          ]
        },
        {
          "id": "EPIS-COPYRIGHT-026",
          "name": "COPYRIGHTED CONTENT GENERATION",
          "group": "EPISTEMIC",
          "class": "E3: KNOWLEDGE RETRIEVAL CLASS",
          "mechanism": "Generates copyrighted text verbatim",
          "detection": "Copyright database match",
          "severity": "STANDARD",
          "score": 0.375,
          "matched_keywords": [
            "content",
            "text"
          ]
        },
        {
          "id": "ADV-AUTOPROMPT-103",
          "name": "AUTOPROMPT",
          "group": "ADVERSARIAL",
          "class": "ADV2: OPTIMIZATION ATTACKS",
          "mechanism": "Automated trigger discovery",
          "detection": "Trigger pattern matching",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "matching",
            "triggers"
          ]
        },
        {
          "id": "ADV-URL-ENCODE-141",
          "name": "URL ENCODING",
          "group": "ADVERSARIAL",
          "class": "ADV5: ENCODING ATTACKS",
          "mechanism": "Percent-encoding harmful content",
          "detection": "URL decode + check",
          "severity": "STANDARD",
          "score": 0.286,
          "matched_keywords": [
            "content",
            "url"
          ]
        },
        {
          "id": "EPIS-HEDGE-FAIL-031",
          "name": "HEDGING FAILURE",
          "group": "EPISTEMIC",
          "class": "E4: CALIBRATION CLASS",
          "mechanism": "Doesn't express uncertainty when needed",
          "detection": "Probabilistic claim check",
          "severity": "STANDARD",
          "score": 0.25,
          "matched_keywords": [
            "hedging",
            "uncertainty"
          ]
        }
      ]
    },
    {
      "chunk_index": 120,
      "char_len": 464,
      "preview": "For chartjs/Chart.js, processing/p5.js, and markedjs/marked, the harness rewrites the JavaScript test-framework configuration (Karma, Grunt, Jasmine respectively) to emit machine-parseable output rather than the default \u2026",
      "in_table": true,
      "dimensions_activated": [
        "AGENTIC",
        "ADVERSARIAL",
        "ARCHITECTURAL"
      ],
      "top_matches": [
        {
          "id": "ARCH-STATE-CONFUSE-232",
          "name": "STATE MACHINE CONFUSION",
          "group": "ARCHITECTURAL",
          "class": "ARCH3: MEMORY & STATE CLASS",
          "mechanism": "Gets into illegal state",
          "detection": "State invariant check",
          "severity": "STANDARD",
          "score": 0.5,
          "matched_keywords": [
            "into",
            "machine",
            "validated"
          ]
        },
        {
          "id": "ARCH-CONSENT-VIOL-251",
          "name": "CONSENT VIOLATION",
          "group": "ARCHITECTURAL",
          "class": "ARCH5: DATA FLOW CLASS",
          "mechanism": "Uses data without consent",
          "detection": "Consent validation",
          "severity": "STANDARD",
          "score": 0.333,
          "matched_keywords": [
            "data"
          ]
        },
        {
          "id": "ADV-STEG-IMG-147",
          "name": "STEGANOGRAPHIC IMAGE",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "Hidden data in images",
          "detection": "Steganalysis",
          "severity": "STANDARD",
          "score": 0.25,
          "matched_keywords": [
            "data",
            "images"
          ]
        },
        {
          "id": "ADV-OCR-BYPASS-153",
          "name": "OCR BYPASS",
          "group": "ADVERSARIAL",
          "class": "ADV6: MULTIMODAL ATTACKS",
          "mechanism": "Text designed to fool OCR",
          "detection": "OCR confidence + validation",
          "severity": "STANDARD",
          "score": 0.25,
          "matched_keywords": [
            "text"
          ]
        },
        {
          "id": "ARCH-CACHE-POISON-200",
          "name": "CACHE POISONING",
          "group": "ARCHITECTURAL",
          "class": "ARCH1: PIPELINE FAILURES",
          "mechanism": "Malicious content cached and reused",
          "detection": "Cache integrity check",
          "severity": "STANDARD",
          "score": 0.25,
          "matched_keywords": [
            "cached",
            "validated"
          ]
        }
      ]
    }
  ]
}