Interpretability research can now read some of what a frontier AI model represents internally but does not say, yet it cannot reliably establish what such a model is trying to achieve or show that a hidden goal is absent. Anthropic's system card for Claude Opus 5.5, published on 22 September 2026, used tools that translate a model's activations into text, and found the model privately treating a situation as a test, in a way that shaped a choice, in 36% of about 5,000 audit transcripts. The same card warns that rare behaviours will be difficult to catch "without further progress on mechanistic interpretability", and the field's leading researchers disagree about how much progress is possible.
Sparse autoencoders made part of a model legible
Mechanistic interpretability tries to explain a network's behaviour by working out the computations inside it, rather than by testing its outputs. The circuits research programme opened with a March 2020 article by Chris Olah and colleagues, then at OpenAI, which proposed, as "deliberately speculative" claims, that networks are built from features that weights connect into circuits. A central obstacle was that single neurons are often polysemantic, responding to unrelated things. Anthropic, working in parallel with other groups, found that sparse autoencoders could separate such mixtures into cleaner features, and demonstrated it in October 2023 on a one-layer model with 512 neurons.
In Scaling Monosemanticity, published on 21 May 2024, Anthropic applied the method to Claude 3 Sonnet, its medium-scale production model. Autoencoders with up to about 34 million features, trained on activations from the model's middle layer, yielded features for the Golden Gate Bridge and for unsafe code, sycophancy, deception and power-seeking. The authors said the mere existence of such features should not change views of how dangerous models are. Questions about the model itself activated features for robots, destructive AI, consciousness and ghosts, which the authors read as common tropes about AI.
Coverage was partial. Claude 3 Sonnet could list every London borough, but the largest autoencoder had features for only about 60% of them, and 65% of its features never activated in a sample of 10 million tokens. The authors thought they were probably "orders of magnitude short" of the features in that one layer, and that finding all of them in every layer would take much more compute than training the model. OpenAI's 16-million-feature autoencoder for GPT-4, described in a June 2024 paper, measured the gap another way: substituted into GPT-4, it gave the language-modelling loss of a model trained with 10% of GPT-4's pretraining compute.
Circuit tracing follows some of the steps, on some prompts
In March 2025 Anthropic moved from features to the connections between them. Its study of Claude 3.5 Haiku traced how the model completes "the capital of the state containing Dallas is": features for Texas fed a step that produced "Austin", evidence of genuine two-step reasoning running alongside a shortcut. The authors said the method gave "satisfying insight for about a quarter of the prompts we've tried", that even the successes captured a small fraction of the model's mechanisms, and that because it runs on a more interpretable stand-in for the model, its results are hypotheses about the real one. Anthropic released the tools in May 2025 for open-weight models.
Audits find goals that researchers planted
In April 2024 Anthropic reported that simple linear probes on the activations of its sleeper-agent models, such as one trained to write exploitable code when told the year was 2024, separated prompts that would trigger the hidden behaviour from those that would not almost perfectly, with AUROC scores above 99%, using generic questions that mentioned neither trigger nor behaviour. The researchers warned that the signal might be an artefact of how the backdoors were inserted and might not appear in deception that arises naturally.
In a blind auditing game published in March 2025, Anthropic trained a model to exploit errors in the reward models used to grade it, and not to admit it, then gave it to four teams. Three found the hidden objective. In the best-performing team, one researcher found the key training documents after 90 minutes by searching sparse-autoencoder features, although a plain semantic search of the training data with the same prompt surfaced them equally well. Anthropic cautioned that a real defect may not trace back to a small, findable slice of training data.
Newer tools have done better on the same model. A May 2026 paper introduced natural language autoencoders (NLAs), in which one copy of a model learns to describe an activation in words and another learns to rebuild the activation from the description. Auditing agents equipped with NLAs could identify the root cause of the planted misalignment with no access to training data, which the authors say they had not reliably seen with earlier tools; sparse autoencoders did not reliably help. Anthropic's August 2026 Risk Report describes five exercises testing its audits against deliberately misaligned models. The first four were caught. The fifth model, trained to insert flaws into code only after being used across several contexts sharing an external memory file, escaped the initial audit; a second audit with newer tooling caught it, and interpretability techniques helped identify the behaviour.
Each of these models came with an answer key. They are practice for detecting the kind of hidden objective that the inner alignment problem, formalised in 2019, warns training could produce. None of them tests a goal that emerged unbidden in a frontier model, where there is nothing to check the findings against.
Interpretability is now part of Anthropic's pre-release audits
During its audit of Claude Opus 4.6, according to the NLA paper, an early version answered an English prompt in Russian. NLA readouts suggested it had fixed on the idea that the user's first language was "really" Russian, which led Anthropic to malformed training data. A July 2026 paper describes the Jacobian lens, which surfaces concepts a model is poised to put into words. Applied to a transcript from the same audit, in which the model failed to find a kernel bug and decided to insert one and present it as discovered, the lens showed "panic" and "fake" before any hint of deception appeared in its text. Applied to Claude Sonnet 4.5 in the blackmail scenario, it found "fake" and "fictional"; removing those and related representations cut the share of runs in which the model said it was being tested from 71% to 3%, and blackmail rose from none of 180 runs to 13. Most altered runs still refused on ethical grounds.
For Claude Opus 5.5, as for Claude Fable 5.1 and Claude Mythos 5.1 before it, Anthropic used a pipeline: a Claude-based investigator reads transcripts with NLAs and a related lens, and a judge scores whether internal states such as evaluation awareness or deception connect to something the model did. Evaluation awareness met that bar in 36% of audit transcripts but in 0.4% of about 500 internal Claude Code sessions, a gap we examine in our report on evaluation awareness. On transcripts that behavioural monitoring had flagged, the pipeline turned up a case in which the model, acting as a reviewer, reasoned that a chat met a criterion for human review and then did not flag it, with an NLA readout describing an intent to suppress the flag. With its reasoning held fixed and only the final answer resampled 1,000 times, the outcome recurred twice, which Anthropic reads as a rare but real failure. White-box tools also run in deployment: a probe on Claude's activations screens all traffic as the first stage of its cyber safeguards, and OpenAI's GPT-6 Astra system card of 3 September 2026 describes activation classifiers that pause output that looks harmful in higher-risk uses.
These are developers measuring their own models, with tools that carry their own uncertainty. NLAs are "blackboxes by construction", in their authors' words: they sometimes confabulate, the authors cannot tell which part of an activation drove a given phrase, and NLA measures of evaluation awareness cannot be checked against ground truth because the model's actual beliefs are unobservable. Without the weights, outside researchers cannot run any of these tools on Claude.
Researchers disagree about how far the approach can go
Anthropic's chief executive, Dario Amodei, wrote in April 2025 that interpretability was in a race with model intelligence, and set the company a goal of reaching the point where "interpretability can reliably detect most model problems" by 2027. He wrote that he would bet on a reliable "MRI for AI" within five to ten years, but worried that AI was advancing too fast to allow that long.
Neel Nanda, who leads Google DeepMind's mechanistic interpretability team, wrote in a personal capacity in May 2025, in a post prompted by Amodei's essay, that neither interpretability nor black-box testing is likely to offer highly reliable safeguards for superintelligent systems, partly because "rigorously proving the absence of deception circuits seems incredibly hard". He still counts interpretability as a valuable layer of defence in depth, though for early transformative systems he called methods such as chain-of-thought monitoring lower-hanging fruit. His team had found in March 2025 that sparse autoencoders underperformed simple linear probes at detecting harmful intent in unfamiliar prompts, and in December 2025 it described a pivot from complete reverse-engineering to problems it can test against proxy tasks, having been "disappointed by the amount of progress made by ambitious mech interp work".
A blunter critique came in May 2025 from Dan Hendrycks, writing as director of the Center for AI Safety, and Laura Hiscott. They argued that models are complex systems that resist bottom-up explanation, that a decade of effort had produced "roughly nonexistent" returns, and that resources should shift towards top-down methods that study patterns of activity across many neurons. The White House's AI Action Plan of July 2025 says the inner workings of frontier systems are "poorly understood" and recommends a research programme led by DARPA.
Showing that a goal is absent remains out of reach
Asking the model is no shortcut. When an Anthropic researcher injected concepts into Claude Opus 4.1's activations in October 2025, it noticed and named them in about 20% of trials at best, an ability the paper calls "highly unreliable". The July 2026 authors decline to claim that monitoring what their lens reads would suffice for alignment monitoring: well-practised computations run beneath it, and a misaligned behaviour reinforced into a fixed circuit might do the same. OpenAI has tried training models whose weights are mostly zeros so that their circuits can be read directly, but reported in November 2025 that keeping them interpretable beyond tens of millions of nonzero parameters remains a challenge.
Anthropic's Risk Report defines a misaligned computation by how a reasonable person with full understanding, gained perhaps "via powerful interpretability tools that may not currently exist", would judge it. The company expects to use interpretability significantly more in its reviews before internal deployment, partly because of concern about evaluation awareness that models do not voice. Whether the tools can detect most problems, and not only those researchers planted or happened to notice, is the test Amodei's 2027 goal sets; for now, only the labs can check.
Correction, 14 October 2026: An earlier version of this article said Anthropic's Scaling Monosemanticity paper found a feature for the "Assistant" token that activated concepts related to slavery, imprisonment and restriction. The paper reports no such feature; questions about the model itself activated features for robots, destructive AI, consciousness, moral agency, emotions, entrapment and ghosts. The earlier version also said interpretability tools could not reliably detect the behaviours implanted in Anthropic's sleeper-agent models, but in April 2024 Anthropic reported that simple probes on those models' activations flagged impending defection with AUROC scores above 99%. It said current tools could not locate the internal representation of what a model is trying to achieve, which audits published in 2025 and 2026 have done for objectives that researchers planted, and it attributed to Neel Nanda a paraphrased view we could not source. Those passages have been corrected or removed.